Pin certificates when requested by user

Also --revoke-certs will revoke (remove) pinned certificates to
allow the user to reset w/o using keyring/pkcs manager.