Support future certs & keeping certs in S3 until they expire

Four major changes:
 * certs uploaded to S3 now expire when the cert expires
 * Added an option to issue certs to be active in the future (--starts-in)
 * Workaround ssh-keygen bug which incorrectly handles DST with the YYYYMMDDHHMMSS format
 * Write audit log valid_for in YYYYMMDDHHMMSS:YYYYMMDDHHMMSS format rather then just whatever the user specifies on the CLI
I'd definitely try to follow PEP 257 for docstrings (it's hinted at in PEP8)

http://legacy.python.org/dev/peps/pep-0257/
http://legacy.python.org/dev/peps/pep-0008/#block-comments