In order to supported #83, we could create a self signed certificate issuer.

This issuing backend would simply sign certificates using themselves. This will allow us to easily 'seed' a CA issuer with a signed CA keypair.

/kind feature