DecodedCert doesn't own the der value, so it should be const. Had to make many other changes downstream of this.