The caller's certificates
Apple's /v1/certificates resource id.
Expiry in epoch millis (from the X.509 notAfter).
True if we hold the private key (a .p12 can be downloaded); false for imported/reconciled certs.