Now that I've thought this through better (see slides at https://docs.google.com/presentation/d/1dc7-uWNIHd6qMNlhWxfwCnzACQaSL2vfkHqP_qdpkac and screenshot of key slide below), I need to go back to having what is currently called certificate_models to CRD somehow.
