diff --git a/sop-java-picocli/src/main/java/sop/cli/picocli/commands/GenerateKeyCmd.java b/sop-java-picocli/src/main/java/sop/cli/picocli/commands/GenerateKeyCmd.java
index bab7280..d215baf 100644
--- a/sop-java-picocli/src/main/java/sop/cli/picocli/commands/GenerateKeyCmd.java
+++ b/sop-java-picocli/src/main/java/sop/cli/picocli/commands/GenerateKeyCmd.java
@@ -23,7 +23,7 @@ public class GenerateKeyCmd extends AbstractSopCmd {
             negatable = true)
     boolean armor = true;
 
-    @CommandLine.Parameters
+    @CommandLine.Parameters(paramLabel = "USERID")
     List<String> userId = new ArrayList<>();
 
     @CommandLine.Option(names = "--with-key-password",
diff --git a/sop-java-picocli/src/main/resources/msg_decrypt.properties b/sop-java-picocli/src/main/resources/msg_decrypt.properties
index c7dca86..46f0fb1 100644
--- a/sop-java-picocli/src/main/resources/msg_decrypt.properties
+++ b/sop-java-picocli/src/main/resources/msg_decrypt.properties
@@ -10,7 +10,7 @@ with-password.0=Symmetric passphrase to decrypt the message with.
 with-password.1=Enables decryption based on any "SKESK" packets in the "CIPHERTEXT".
 with-password.2=Is an INDIRECT data type (e.g. file, environment variable, file descriptor...)
 verify-out=Emits signature verification status to the designated output
-certs=Certificates for signature verification
+verify-with=Certificates for signature verification
 not-before.0=ISO-8601 formatted UTC date (e.g. '2020-11-23T16:35Z)
 not-before.1=Reject signatures with a creation date not in range.
 not-before.2=Defaults to beginning of time ('-').
@@ -20,4 +20,4 @@ not-after.2=Defaults to current system time ('now').
 not-after.3=Accepts special value '-' for end of time.
 with-key-password.0=Passphrase to unlock the secret key(s).
 with-key-password.1=Is an INDIRECT data type (e.g. file, environment variable, file descriptor...).
-keys=Secret keys to attempt decryption with
+KEY[0..*]=Secret keys to attempt decryption with
diff --git a/sop-java-picocli/src/main/resources/msg_decrypt_de.properties b/sop-java-picocli/src/main/resources/msg_decrypt_de.properties
index 2b0cc0d..bc3e58f 100644
--- a/sop-java-picocli/src/main/resources/msg_decrypt_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_decrypt_de.properties
@@ -10,7 +10,7 @@ with-password.0=Symmetrisches Passwort zur Entschl
 with-password.1=Ermöglicht Entschlüsselung basierend auf im "CIPHERTEXT" enthaltenen "SKESK" Paketen.
 with-password.2=Ist INDIREKTER Datentyp (z.B.. Datei, Umgebungsvariable, Dateideskriptor...).
 verify-out=Schreibe Status der Signaturprüfung in angegebene Ausgabe
-certs=Zertifikate zur Signaturprüfung
+verify-with=Zertifikate zur Signaturprüfung
 not-before.0=Nach ISO-8601 formatierter UTC Zeitstempel (z.B.. '2020-11-23T16:35Z)
 not-before.1=Lehne Signaturen mit Erstellungsdatum außerhalb des Gültigkeitsbereichs ab.
 not-before.2=Standardmäßig: Anbeginn der Zeit ('-').
@@ -20,4 +20,4 @@ not-after.2=Standardm
 not-after.3=Akzeptiert speziellen Wert '-' für das Ende aller Zeiten.
 with-key-password.0=Passwort zum Entsperren der privaten Schlüssel
 with-key-password.1=Ist INDIREKTER Datentyp (z.B.. Datei, Umgebungsvariable, Dateideskriptor...).
-keys=Private Schlüssel zum Entschlüsseln der Nachricht
+KEY[0..*]=Private Schlüssel zum Entschlüsseln der Nachricht
diff --git a/sop-java-picocli/src/main/resources/msg_detached-sign.properties b/sop-java-picocli/src/main/resources/msg_detached-sign.properties
index 8b51124..9f75641 100644
--- a/sop-java-picocli/src/main/resources/msg_detached-sign.properties
+++ b/sop-java-picocli/src/main/resources/msg_detached-sign.properties
@@ -2,11 +2,11 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Create a detached signature on the data from standard input
-armor=ASCII armor the output
+no-armor=ASCII armor the output
 as.0=Specify the output format of the signed message
 as.1=Defaults to 'binary'.
 as.2=If '--as=text' and the input data is not valid UTF-8, sign fails with return code 53.
 with-key-password.0=Passphrase to unlock the secret key(s).
 with-key-password.1=Is an INDIRECT data type (e.g. file, environment variable, file descriptor...).
 micalg-out=Emits the digest algorithm used to the specified file in a way that can be used to populate the micalg parameter for the PGP/MIME Content-Type (RFC3156)
-keys=Secret keys used for signing
+KEYS[0..*]=Secret keys used for signing
diff --git a/sop-java-picocli/src/main/resources/msg_detached-sign_de.properties b/sop-java-picocli/src/main/resources/msg_detached-sign_de.properties
index fdd310a..c2053a2 100644
--- a/sop-java-picocli/src/main/resources/msg_detached-sign_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_detached-sign_de.properties
@@ -2,11 +2,11 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Erstelle abgetrennte Signatur über Nachricht von Standard-Eingabe
-armor=Schütze Ausgabe mit ASCII Armor
+no-armor=Schütze Ausgabe mit ASCII Armor
 as.0=Bestimme Signaturformat der Nachricht.
 as.1=Standardmäßig: 'binary'.
 as.2=Ist die Standard-Eingabe nicht UTF-8 kodiert und '--as=text' gesetzt, so wird inline-sign Fehlercode 53 zurückgeben.
 with-key-password.0=Passwort zum Entsperren des privaten Schlüssels
 with-key-password.1=Ist ein INDIREKTER Datentyp (z.B.. Datei, Umgebungsvariable, Dateideskriptor...).
 micalg-out=Gibt den verwendeten Digest-Algorithmus an die angegebene Ausgabe in einer Form aus, die zum Auffüllen des micalg-Parameters für den PGP/MIME Content-Type (RFC3156) verwendet werden kann.
-keys=Private Signaturschlüssel
+KEYS[0..*]=Private Signaturschlüssel
diff --git a/sop-java-picocli/src/main/resources/msg_detached-verify.properties b/sop-java-picocli/src/main/resources/msg_detached-verify.properties
index 5e4f4b6..afacdbd 100644
--- a/sop-java-picocli/src/main/resources/msg_detached-verify.properties
+++ b/sop-java-picocli/src/main/resources/msg_detached-verify.properties
@@ -9,5 +9,5 @@ not-after.1=ISO-8601 formatted UTC date (e.g. '2020-11-23T16:35Z)
 not-after.2=Reject signatures with a creation date not in range.
 not-after.3=Defaults to current system time ("now").\
 not-after.4 = Accepts special value "-" for end of time.
-signature=Detached signature
-certs=Public key certificates for signature verification
+SIGNATURE[0]=Detached signature
+CERT[0..*]=Public key certificates for signature verification
diff --git a/sop-java-picocli/src/main/resources/msg_detached-verify_de.properties b/sop-java-picocli/src/main/resources/msg_detached-verify_de.properties
index b5d669e..f69bf0b 100644
--- a/sop-java-picocli/src/main/resources/msg_detached-verify_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_detached-verify_de.properties
@@ -9,5 +9,5 @@ not-after.0=Nach ISO-8601 formatierter UTC Zeitstempel (z.B.. '2020-11-23T16:35Z
 not-after.1=Lehne Signaturen mit Erstellungsdatum außerhalb des Gültigkeitsbereichs ab.
 not-after.2=Standardmäßig: Aktueller Zeitunkt ('now').
 not-after.3=Akzeptiert speziellen Wert '-' für das Ende aller Zeiten.
-signature=Abgetrennte Signatur
-certs=Zertifikate (öffentliche Schlüssel) zur Signaturprüfung
+SIGNATURE[0]=Abgetrennte Signatur
+CERT[0..*]=Zertifikate (öffentliche Schlüssel) zur Signaturprüfung
diff --git a/sop-java-picocli/src/main/resources/msg_encrypt.properties b/sop-java-picocli/src/main/resources/msg_encrypt.properties
index 3339187..4bd7051 100644
--- a/sop-java-picocli/src/main/resources/msg_encrypt.properties
+++ b/sop-java-picocli/src/main/resources/msg_encrypt.properties
@@ -2,11 +2,11 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Encrypt a message from standard input
-armor=ASCII armor the output
-type=Type of the input data. Defaults to 'binary'
+no-armor=ASCII armor the output
+as=Type of the input data. Defaults to 'binary'
 with-password.0=Encrypt the message with a password.
 with-password.1=Is an INDIRECT data type (e.g. file, environment variable, file descriptor...)
 sign-with=Sign the output with a private key
 with-key-password.0=Passphrase to unlock the secret key(s).
 with-key-password.1=Is an INDIRECT data type (e.g. file, environment variable, file descriptor...).
-certs=Certificates the message gets encrypted to
+CERTS[0..*]=Certificates the message gets encrypted to
diff --git a/sop-java-picocli/src/main/resources/msg_encrypt_de.properties b/sop-java-picocli/src/main/resources/msg_encrypt_de.properties
index d364f62..1bfab33 100644
--- a/sop-java-picocli/src/main/resources/msg_encrypt_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_encrypt_de.properties
@@ -2,11 +2,11 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Verschlüssle eine Nachricht von Standard-Eingabe
-armor=Schütze Ausgabe mit ASCII Armor
-type=Format der Nachricht. Standardmäßig 'binary'
+no-armor=Schütze Ausgabe mit ASCII Armor
+as=Format der Nachricht. Standardmäßig 'binary'
 with-password.0=Verschlüssle die Nachricht mit einem Passwort
 with-password.1=Ist ein INDIREKTER Datentyp (z.B.. Datei, Umgebungsvariable, Dateideskriptor...).
 sign-with=Signiere die Nachricht mit einem privaten Schlüssel
 with-key-password.0=Passwort zum Entsperren der privaten Schlüssel
 with-key-password.1=Ist INDIREKTER Datentyp (z.B.. Datei, Umgebungsvariable, Dateideskriptor...).
-certs=Zertifikate für die die Nachricht verschlüsselt werden soll
+CERTS[0..*]=Zertifikate für die die Nachricht verschlüsselt werden soll
diff --git a/sop-java-picocli/src/main/resources/msg_extract-cert.properties b/sop-java-picocli/src/main/resources/msg_extract-cert.properties
index bf285bc..77c04db 100644
--- a/sop-java-picocli/src/main/resources/msg_extract-cert.properties
+++ b/sop-java-picocli/src/main/resources/msg_extract-cert.properties
@@ -2,4 +2,4 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Extract a public key certificate from a secret key from standard input
-armor=ASCII armor the output
+no-armor=ASCII armor the output
diff --git a/sop-java-picocli/src/main/resources/msg_extract-cert_de.properties b/sop-java-picocli/src/main/resources/msg_extract-cert_de.properties
index f13d5cd..a35bda4 100644
--- a/sop-java-picocli/src/main/resources/msg_extract-cert_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_extract-cert_de.properties
@@ -2,4 +2,4 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Extrahiere Zertifikat (öffentlichen Schlüssel) aus privatem Schlüssel von Standard-Eingabe
-armor=Schütze Ausgabe mit ASCII Armor
+no-armor=Schütze Ausgabe mit ASCII Armor
diff --git a/sop-java-picocli/src/main/resources/msg_generate-key.properties b/sop-java-picocli/src/main/resources/msg_generate-key.properties
index 36145bb..29eb284 100644
--- a/sop-java-picocli/src/main/resources/msg_generate-key.properties
+++ b/sop-java-picocli/src/main/resources/msg_generate-key.properties
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Generate a secret key
-armor=ASCII armor the output
-user-id=User-ID, e.g. "Alice <alice@example.com>"
+no-armor=ASCII armor the output
+USERID[0..*]=User-ID, e.g. "Alice <alice@example.com>"
 with-key-password.0=Password to protect the private key with
 with-key-password.1=Is an INDIRECT data type (e.g. file, environment variable, file descriptor...).
diff --git a/sop-java-picocli/src/main/resources/msg_generate-key_de.properties b/sop-java-picocli/src/main/resources/msg_generate-key_de.properties
index 3d3869c..60b2e21 100644
--- a/sop-java-picocli/src/main/resources/msg_generate-key_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_generate-key_de.properties
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Generiere einen privaten Schlüssel
-armor=Schütze Ausgabe mit ASCII Armor
-user-id=Nutzer-ID, z.B.. "Alice <alice@example.com>"
+no-armor=Schütze Ausgabe mit ASCII Armor
+USERID[0..*]=Nutzer-ID, z.B.. "Alice <alice@example.com>"
 with-key-password.0=Passwort zum Schutz des privaten Schlüssels
 with-key-password.1=Ist ein INDIREKTER Datentyp (z.B.. Datei, Umgebungsvariable, Dateideskriptor...).
diff --git a/sop-java-picocli/src/main/resources/msg_inline-detach.properties b/sop-java-picocli/src/main/resources/msg_inline-detach.properties
index 5500aaa..5963f88 100644
--- a/sop-java-picocli/src/main/resources/msg_inline-detach.properties
+++ b/sop-java-picocli/src/main/resources/msg_inline-detach.properties
@@ -2,5 +2,5 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Split signatures from a clearsigned message
-armor=ASCII armor the output
+no-armor=ASCII armor the output
 signatures-out=Destination to which a detached signatures block will be written
diff --git a/sop-java-picocli/src/main/resources/msg_inline-detach_de.properties b/sop-java-picocli/src/main/resources/msg_inline-detach_de.properties
index a2bb0ad..ffe058b 100644
--- a/sop-java-picocli/src/main/resources/msg_inline-detach_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_inline-detach_de.properties
@@ -2,5 +2,5 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Trenne Signaturen von Klartext-signierter Nachricht
-armor=Schütze Ausgabe mit ASCII Armor
+no-armor=Schütze Ausgabe mit ASCII Armor
 signatures-out=Schreibe abgetrennte Signaturen in Ausgabe
diff --git a/sop-java-picocli/src/main/resources/msg_inline-sign.properties b/sop-java-picocli/src/main/resources/msg_inline-sign.properties
index ca53d22..efe5c5f 100644
--- a/sop-java-picocli/src/main/resources/msg_inline-sign.properties
+++ b/sop-java-picocli/src/main/resources/msg_inline-sign.properties
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Create an inline-signed message from data on standard input
-armor=ASCII armor the output
+no-armor=ASCII armor the output
 as.0=Specify the signature format of the signed message
 as.1='text' and 'binary' will produce inline-signed messages.
 as.2='cleartextsigned' will make use of the cleartext signature framework.
@@ -11,4 +11,4 @@ as.4=If '--as=text' and the input data is not valid UTF-8, inline-sign fails wit
 with-key-password.0=Passphrase to unlock the secret key(s).
 with-key-password.1=Is an INDIRECT data type (e.g. file, environment variable, file descriptor...).
 micalg=Emits the digest algorithm used to the specified file in a way that can be used to populate the micalg parameter for the PGP/MIME Content-Type (RFC3156)
-keys=Secret keys used for signing
+KEYS[0..*]=Secret keys used for signing
diff --git a/sop-java-picocli/src/main/resources/msg_inline-sign_de.properties b/sop-java-picocli/src/main/resources/msg_inline-sign_de.properties
index 8c9d000..dd5387d 100644
--- a/sop-java-picocli/src/main/resources/msg_inline-sign_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_inline-sign_de.properties
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 usage.header=Signiere eine Nachricht von Standard-Eingabe mit eingebetteten Signaturen
-armor=Schütze Ausgabe mit ASCII Armor
+no-armor=Schütze Ausgabe mit ASCII Armor
 as.0=Bestimme Signaturformat der Nachricht.
 as.1='text' und 'binary' resultieren in eingebettete Signaturen.
 as.2='cleartextsigned' wird die Nachricht Klartext-signieren.
@@ -11,4 +11,4 @@ as.4=Ist die Standard-Eingabe nicht UTF-8 kodiert und '--as=text' gesetzt, so wi
 with-key-password.0=Passwort zum Entsperren des privaten Schlüssels
 with-key-password.1=Ist ein INDIREKTER Datentyp (z.B.. Datei, Umgebungsvariable, Dateideskriptor...).
 micalg=Gibt den verwendeten Digest-Algorithmus an die angegebene Ausgabe in einer Form aus, die zum Auffüllen des micalg-Parameters für den PGP/MIME Content-Type (RFC3156) verwendet werden kann.
-keys=Private Signaturschlüssel
+KEYS[0..*]=Private Signaturschlüssel
diff --git a/sop-java-picocli/src/main/resources/msg_inline-verify.properties b/sop-java-picocli/src/main/resources/msg_inline-verify.properties
index e3388c5..bde6622 100644
--- a/sop-java-picocli/src/main/resources/msg_inline-verify.properties
+++ b/sop-java-picocli/src/main/resources/msg_inline-verify.properties
@@ -10,4 +10,4 @@ not-after.1=Reject signatures with a creation date not in range.
 not-after.2=Defaults to current system time ("now").
 not-after.3=Accepts special value "-" for end of time.
 verifications-out=File to write details over successful verifications to
-certs=Public key certificates for signature verification
+CERT[0..*]=Public key certificates for signature verification
diff --git a/sop-java-picocli/src/main/resources/msg_inline-verify_de.properties b/sop-java-picocli/src/main/resources/msg_inline-verify_de.properties
index 39268ad..0adf42b 100644
--- a/sop-java-picocli/src/main/resources/msg_inline-verify_de.properties
+++ b/sop-java-picocli/src/main/resources/msg_inline-verify_de.properties
@@ -10,4 +10,4 @@ not-after.1=Lehne Signaturen mit Erstellungsdatum au
 not-after.2=Standardmäßig: Aktueller Zeitunkt ('now').
 not-after.3=Akzeptiert speziellen Wert '-' für das Ende aller Zeiten.
 verifications-out=Schreibe Status der Signaturprüfung in angegebene Ausgabe
-certs=Zertifikate (öffentlich Schlüssel) zur Signaturprüfung
+CERT[0..*]=Zertifikate (öffentlich Schlüssel) zur Signaturprüfung