Use proper X509 Certificate Requests and have the server just do the
signing. Also removes a bit of cruft in the API.