newLeafCertificate
suspend fun newLeafCertificate(parent: CertificateChain, groupKey: EccKey, signingKey: EccKey, encryptionKey: EccKey, certId: ByteArray = randomBytes(16), clientId: ByteArray = randomBytes(16), expiry: Long = NEVER_EXPIRES): Certificate
Issue a DEVICE certificate for signingKey and encryptionKey, signed by groupKey.
The manufacturer details are carried over from parent's leaf, because they identify the hardware the group certificate was issued for and are not ours to invent.
Throws
if parent cannot issue device certificates