Once we have pki-playground creating platform identity certs (oxidecomputer/pki-playground#84) we can use that code in place of the openssl crimes we're currently committing.

I had initially hoped to do this w/ a library from pki-playground but that feels premature. Better to implement this w/ purpose-built code here initially to get a feeling for what we need / want and the right ergonomics for it. Once we know what we need we can turn it into a library.