when a user has not confirmed a device as their own, and they are autheticating with a primary email address, convey to the primary that a shorter cert duration should be used