Submit pending certs to consistent store

Well, it's sort of not broken (with or without etcd) if you don't actually want to see any of the certs you've added ever get merged into the tree :)
Once this PR goes in the log's mostly useless until I get the sequencer & signer stuff fixed up and merged too.