But in general the process should be fully scripted short of signing, which itself should be a single command