WIP: Refactor certificate agent and queue

Details to follow...
I also like the unified interface here, even though I don't love _reply(), I love that there's just one response call here that dtrt.