Allow sub-class certificate

[alex]

This is to enable folks who previously subclassed teh ABC to persist

[reaperhulk]

Should we allow subclassing on all of them or wait for users to request?

If we consider subclassing officially part of our public surface we should add a test that simply subclasses without an exception with a small comment explaining why.

[alex]

I suppose it's a begrudgingly supported part of our API surface. I'll add a test. No reason to extend it further though.

[alex]

It's a good thing you told me to add a test. While subclassing now works, it's not actually possible to instantiate an instance of this AFAICT.

[alex]

I'm not sure what the correct way to proceed is, as we don't want these to be instantiable normally.