In order to setup event log writing, the agent must be installed with certkit-agent.exe install and run as a service. Writes to the Application log for now with CertKit as the source. (Setting up a custom log requires a manifest and some other trickery which felt like a bridge too far at the moment)

Can read the latest logs via powershell with:

Get-WinEvent -LogName Application -MaxEvents 50 | Where-Object { $_.ProviderName -eq "CertKit" }