Close #30

There were two bugs.  First, we were allowing null `ctime`s on
tracking certs.  And second, tracking certs didn't have ctimes.
Fix both of those problems here.