Bug 929066 - Allow for local clock skew.

This is a stop-gap, as described in the ticket. It merely issues certs 20 seconds in the past, and assertions 10 seconds in the past. (Assertions must be issued after certificates.) This works around the little bit of local clock skew that's been frustrating me.

@rnewman, trivial review?