Force new certificates to use the new alg names

Stricter rules for certificates formats:

- old format certs required to use an alias
- new format certs forbidden from using an alias

This breaks the old API for generating certificates and requires
users to update the certificate algorithm in their code.
Upgrade 'principal.email' to 'sub' during verification

The old format certs should continue to load properly but their
'principal.email' value now needs to be called 'sub'.
Require the new cert format when signing

Ignore the principal attribute in certificates when signing
certificates since we should require new format certs.

This breaks existing BrowserID shims that haven't upgraded to the
new certificate format yet.