Add internal support for publishing family-certs

This will eventually be used by relays, but for now it's only going to get used
for round-trip testing.