maybe we can extract the certificate generation in a separate function or class ? It would be easier to make a call to FxA in case we decide to delegate certificate generation.