feat(controller): teach controller about application certificates

supercedes #2570, rebased and all comments addressed.
Also, it looks like we do this other places.