Include 'generation' field in signed certificates.

Preliminary implementation of #486.  This all needs to be revisited for new-format certificates, but this should be enough to get things working for now.  @dannycoates r?