NewCertificateAuthorityImpl creates a CA instance that can sign certificates from any number of issuance.Issuers according to their profiles, and can sign OCSP (via delegation to an ocspImpl and its issuers).

NewCRLImpl returns a new object which fulfils the ca.proto CRLGenerator interface.

OCSPGenerator is an interface which exposes both the auto-generated gRPC methods and our special-purpose log queue start and stop methods, so that they can be called from main without exporting the ocspImpl type.