calculate data rather than using the revoked flag

Cascade delete of CdnCertificate to the Serial
This way we never end up putting CdnCert serials in the crl.
Probably doesn't make much difference, but this seems cleaner