Just support it at `POST /datasets`: think of it as creating a dataset and an initial certificate for that dataset, rather than generating a certificate and a dataset to go with it.