update cert fixtures and simplify tests (#927)

* simplify

* generate new certs and keys with 3072-bit RSA

* black

* add a test to avoid losing coverage

Author: reaperhulk