address review comments

- more inline documentation
 - don't explicitly specify audience
 - approver is optional in `generate_key`
 - ADD -> RUN for better caching of jwtproxy

conf/init/create_certs.sh

@@ -1,7 +1,7 @@
 #! /bin/bash
 set -e
 
-# Create certs
+# Create certs for jwtproxy to mitm outgoing TLS connections
 echo '{"CN":"CA","key":{"algo":"rsa","size":2048}}' | cfssl gencert -initca - | cfssljson -bare mitm
 cp mitm-key.pem /conf/mitm.key
 cp mitm.pem /conf/mitm.cert