move cert parsing to certificate.ml
stop carrying raw around

centralize cert+Cs.t representation around certificate.ml
clean a little