As an alternative to #212, this goes further in the direction of #205,
removing `alg` and `key_pair` from `CertificateParams` and requiring the
caller to pass in a reference to them when signing. This seems to have a
number of nice properties:

* `alg` is derived from the passed in `KeyPair`, so key algorithm
mismatch errors can no longer occur
* No need for passing in a signing algorithm when parsing from
pre-existing parameters or key pairs
* Should make it easy to support long-lived (remote) key pairs

The main downside as far as I can see is that the top-level API gets a
bit more complicated, because generating a `KeyPair` must now be done by
the caller, and for now we force them to pick a signing algorithm. I
think we might mitigate this by adding a no-argument constructor like
`generate_default()` (or use `generate()` for the no-argument variant
and `generate_for()` for the variant that requires an argument).

Generally, this feels like a clear improvement in the API's design to
me.