WIP: Refactor certificate agent and queue

Details to follow...
Re: env vars

`CERT_PRIVATE_DIR` is currently the only setting which respects
environment variables. I actually already have a WIP which cleans up
`settings.py` (discussed briefly F2F).

I'll include this change with the upcoming PR.