Implement `Issuer#removeProgram`

This simplifies `Program#changeIssuer` a bit by shifting some of the
issuer-specific logic to the issuer model, where it belongs.