certificate/sign produces all-hex "principal.email"

I finally added tests of certificate/sign to my python-based https://github.com/warner/picl-spec-crypto tool, and the signed payload of the cert it returns contains a `principal.email` that is all-hex. It's supposed to contain the (unencoded) email address. These certificates won't work at all with the browserid verifier.

We should probably do a full sweep of all the code that touches this "email" field, and either change the variable/argument/column names to include the type ("email" or "email_hex"), or pick one safe representation and use it everywhere.