security (internal): In Certificate, keep a shared_ptr of the PublicKey.