Strong Ownership of Certificates in `cert-wallet`

Also, I started a new discussion on what multiple keychains on one device might look like. I think it basically captures everything we mentioned here, but feel free to add to that discussion if I missed anything.