Would it make more sense to push the certificate queuing into a script in suse-module-tools instead and then just have the scriptlet call it with @CERTS@ replaced?