Clear certificate field out of json when we are regenerating a public key

This is to fix a bug when we reset a cert to a public key.

After keygen was commited we encountered a bug where we'd reset the
key, set the json to have a public_key field from that reset key, but
fail to clear the cert field. Later, we'd pull the cert in preference
to the public key when updating the record. This would cause the
record to match the old one, and we'd not actually update anything in
the database. However we'd still return both the public key and the
certificate. Unlucky users would pull the private key and assume their
client had been rekeyed, when it hadn't.