Implement Certmeister#fetch

It felt very unnatural to handle store exceptions inside fetch() and
then try to communicate them meaningfully to the caller. Having accepted
that the caller of fetch() needs to decide how to handle store errors,
it was easy to apply the same thinking to sign() and let store errors
percolate up from there too.

Thinking ahead to the rack adapter, treating a store error like a
validation failure isn't helpful; the rack app is going to want to
handle these things differently.