Thinking more, the current *Manager classes are both the CommandClient and the CommandReciever, the *Lib (entcertlib.EntCertLib) are the Invoker.

BaseCertManager -> ActionClient
EntitlementCertManager -> EntCertActionClient
entcertlib.EntCertLib -> EntCertActionInvoker
entcertlib.EntCertUpdateAction becomes -> EntCertActionCommand

Could go the nest step and provide a ActionReciever and EntCertActionReciever.
iiuc, we could consider the state the Action/ActionCommand sets up in it's init as 
the Reciever. Since that's all injected latish, don't think it would change functionality.

I'd also like to split the impl details of say, repolib, elsewhere.