initialize cert collection
validate stale verification key in validate/cancel account APIs
first cut at certificatse based 2fa support