This section probably still needs work, at least to clean up comments.

The certlib/entcertlib/etc split may have been enough to break any circular imports