978322: fixed client deleting certs

If the client and server are out of sync, the client could delete certificates that are actually still valid.
The server sends a list of expected valid entitlements, when one becomes invalid, it will be deleted that way.
Some status information will still be wrong because we cannot effectively synchronize time between the client and server, but the system will still have all valid entitlements.