move cert install/db stuff until we find all cases first.

Goal here is to find the list of stuff to be installed,
potentially call a plugin that could update that info,
then install. So a plugin could blacklist a particular
product id for example.

Also, more doc strings.
comment cleanup
move cert deletion to after collection of certs_to_delete

Allow for a plugin/hook to manipulate the certs_to_delete
list.