The ACME-DA flow in the step ca certificate command expects all KMS parameters
to be provided through the `--attestation-uri` flag. Using the `--kms` flag at the
same time can lead to errors. For example, if the YubiKey PIN is set with the
`--kms` flag, the flow will ignore it and use the default one instead, resulting
in a PIN retry error.

Fixes #1492