Allow signing certificates as secondary authority over the verified email address

Just a little thought experiment, not expecting anyone to merge this :-)

What if we allowed the client to ask for persona-style fallback certificates?  That is, certificates for the user's actual verified email address, but signed by the fxa server as secondary identity authority.  It's a pretty minimal change from an API point of view.  It might terrify @warner though...

This is, in a way, the dual of the https://verifier.accounts.firefox.com API which allows you to customize the list of trusted secondaries - it lets you ask https://api.accounts.firefox.com to act as a secondary authority.

Why would anyone want to do this?  Dunno really, just pondering potential synergies that might stem from our shiny new database full of verified emails...