security (internal): In Certificate.decode, use PublicKey.fromDer.