KEYPAIR

Restrict lookup to certificates that have a private key.