Rework which certs get saved when
    
    Given the new hook framework, we can be save a CA's certificates as
    referred to by an entry whenever the CA's certificates are updated,
    not just when we want to save the entry's own certificate.