It should be in the certificate payload (not the assertion). I forget what we decided (and whether we updated the fxa-auth-server's `certificate/sign` code to the new format: the one with "sub" instead of "principal.email"), but the userid might show up as "sub".