ExpiresAt returns when the given identity expires, or a zero time.Time in case we cannot determine that.

GetRandomBytes returns len random looking bytes.

GetRandomNonce returns a random byte array of length NonceSize.

TrackExpiration warns a week before one of the certificates expires.

NonceSize is the default NonceSize.

Scheduler invokes f after d time, and can be replaced with time.AfterFunc.

WarnFunc notifies a warning happened with the given format, and can be replaced with Warnf of a logger.