Document certificate store implementations

[mithrandi]

There should be documentation about implementing the ICertificateStore interface. In particular, there is a nuance of this interface whereby you can handle keys in a "write-only" fashion; reading a certificate back only needs the certificate (to check the expiration date), not the private key, which is probably better security practice for networked implementations of this.