Currently certificates can only be update during the .fed package configuration. The configuration has to be enhanced to support removal of certificates.