expect public key as opaque JSON value when certifying

The certificate is expected to include the principal public key as a
JSON object, *not serialised*.  Since we don't support the "DS"
algorithm use an Aeson 'Value' value.
use milliseconds for "exp" claim

JWT specifies that datetime claims including "exp" are
'NumericTime', seconds from epoch, but the Persona system seems to
be expecting milliseconds.  Accordingly, multiply the "exp" value by
1000.
add "iat" claim when creating assertion

The Persona system expects an "iat" ("Issued At") claim.  Add this
claim at the current timestamp (in milliseconds).