restructure certs/keys; add key/cert generation

I moved this pull request into a branch so I can mash multiple changes into my master.

I split pem.go into key.go and cert.go, and added methods for manipulating certificates and generating RSA keys. This provides enough functionality to generate a RSA keys, make a CA, and issue a certificate with constraints. cert_test.go demonstrates this process.

NID is also now an exposed type.