Allow for either the speaksfor *or* the user certificate to be expired (previously, we looked for expired speaksfor). If either is expired, we fallback to generating an SA certificate (which we can do cause all slices are in our namespace).
Allow for either the speaksfor *or* the user certificate to be expired
(previously, we looked for expired speaksfor). If either is expired, we
fallback to generating an SA certificate (which we can do cause all
slices are in our namespace).

nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome