removed CSR generation and validation reqs

These are not appropriate for general-purpose applications,
but are likely appropriate for some EPs e.g. VPN client.