Issuing service API for removing a certificate

[mithrandi]

This is necessary, rather than going directly through the ICertificateStore interface, because the issuing service may be in the process of reissuing the certificate, resulting in the new cert being inserted into the store after the removal, "resurrecting" it.

See #76 for the counterpart of this.