Key::list: Skip Certificate::new for empty buffers

This matches the C code behaviour.

src/key.rs

@@ -125,8 +125,10 @@ impl Key {
                 }
             };
 
-            let cert = Certificate::new(buf)?;
+            if !buf.is_empty() {
-            keys.push(Key { slot, cert });
+                let cert = Certificate::new(buf)?;
+                keys.push(Key { slot, cert });
+            }
         }
 
         Ok(keys)