I think that all cert-related functions should go in leap.common.certs
1. place where other components can reuse
2. use a facade that we can easily switch to other crypto backend (gnutls)