Rip out wacky PKI and use a shadow content-addressable tree instead.

Thanks @tarcieri for suggesting this!