First step in on-demand cert generation. We no longer generate certs when...

First step in on-demand cert generation.  We no longer generate certs when syncing, but only when the identity is requested or when generated.

Adding a new function/test called syncEmail, renaming syncEmailKeypairs to syncEmails to better reflect its purpose.