generate a script to retrieve and recover keys (default behavior if multiple matching recovery candidates are found, or if ...

%1 -- generate a script to retrieve and recover keys (default behavior
        if multiple matching recovery candidates are found, or if the
        output file is not specified).
%2 -- retrieve one or more Key Recovery Blobs (default behavior if
        exactly one matching recovery candidate is found, and if the output
        file is specified)
%3 -- retrieve and recover private keys in one step (requires Key
        Recovery Agent certificates and private keys)
SearchToken -- Used to select the keys and certificates to be recovered.
        Can be any of the following:
        Certificate Common Name
        Certificate Serial Number
        Certificate SHA-1 hash (thumbprint)
        Certificate KeyId SHA-1 hash (Subject Key Identifier)
        Requester Name (domain\user)
        UPN (user@domain)
RecoveryBlobOutFile -- output file containing a certificate chain and an
        associated private key, still encrypted to one or more Key Recovery
        Agent certificates.
OutputScriptFile -- output file containing a batch script to retrieve and
        recover private keys.
OutputFileBaseName -- output file base name.
        For %2, any extension is truncated and a certificate-specific
        string and the %4 extension are appended for each key recovery
        blob.  Each file contains a certificate chain and an associated
        private key, still encrypted to one or more Key Recovery Agent
        certificates.
        For %3, any extension is truncated and the %5 extension is
        appended.  Contains the recovered certificate chains and associated
        private keys, stored as a PFX file.