WIP: Refactor certificate agent and queue

Details to follow...
I find this declarative calling of request sort of confusing. _request is a little bit too high-level maybe? And at first glance I can't quite tell what it's doing? 

Could I canvince you to wrap _request in like _push_request and _pop_request that trivially wrap it but make clear what's happening?