Security:  since the *certificate* is no longer part of the consumer document, it no longer makes sense to stuff it into the returned document.