- The certificate builder is a mid-level interface, and should
    therefore use the more user-friendly way of specifying
    expiration.  Furthermore, with this interface we will be able to
    support setting a new expiration in cases where the keys have
    different creation times.

  - See #429.