- create a base cert context, and make functions unaware whether
  they're dealing with the base or derived type
- simplify stores as a result