Abstract away certificate renewal

Renewing a certificate is harder than it should be.

If STAR is supported, we are supposed to do one thing.
If RenewalInfo is supported, we are supposed to do a different thing.
Otherwise, we are supposed to do a third thing (come up with our own algorithm to check for certificate expiration on a regular basis).

I suggest adding a class that delegates to one of these scenarios under the hood so end-users don't have to play with it themselves.