Change the slot allocation logic.

The targets are:

• a device with cert on it, which should be on-line (to get the cert)
• a key with gpgsm's key (it's oK to be not yet available on-line)

• Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>