turn PrivateCertificate into Certificate before serializing it
turn PrivateCertificate into Certificate before serializing it

This doesn't actually change the behavior, but right now it depends on a
very esoteric implementation detail: PrivateCertificate.dumpPEM includes
the private key, but PrivateCertificate.dump, which is just
inherited from Certificate.dump, dumps only the public certificate bits.

Instead of relying on that, just pass back a Certificate with the public
key only, to avoid possible mistakes in handling it.

insequent/vertex,insequent/vertex,glyph/vertex,twisted/vertex,twisted/vertex