Problem: zcertstore uses clumsy mix of hash + list

Solution: move to nice elegant zring hybrid.

This also exposed a proto-bug in zcertstore which would load
certificates from disk without filtering out _secret files. So
depending on the order of filenames after sorting, the secret
certificate would override the normal one, or not. It worked
by accident because _secret came after the normal filename.