imp should log certs that it signs

[garlick]

Certs are revoked by uuid. An empty file with the uuid as name is touched in a directory on the CA. That directory is propagated (by sys admin magic) to everywhere that certs are to be verified.

It would be convenient when generating revocations if the other metadata in a cert were available: for example, to map a userid and/or time and/or "domain" to a uuid after some security event.

It would also be convenient to have at least the cert expiration date associated with the revocation so that the revocation list can be pruned of expired certs.

Possibly each newly signed cert should be copied to some configurable directory on the CA host, perhaps using the uuid as file name. Then revocation could consist of simply moving (or copying) the cert from the certs directory to the revocation directory.