WIP: Refactor certificate agent and queue

Details to follow...
Yeah, history suggests we're not going to get around to implementing this soon...