public API for signing cert generation

[garlick]

As discussed in #16, the flux keygen utility in flux-core needs the ability to generate signing keys for a user. flux-security should provide a public API for it to use, based on the private ones we've developed.

The API would need to get the public cert signed by the CA (or fail, allowing flux keygen to tell the user additional procedures they may need to perform, such as logging into a secure system.

The API will need to access the flux-security config file(s). For testing, there should be a way to direct the API to use a different configuration path.