Beginnings of #47; selective reveal, doesn't generate subset certificates