Robust Intermediate CA

When I have security requirements dictated by my organization, I need to take a CA cert that was signed by my corporate root and use that to sign all my agent certs.

Two areas of work:

• CA setup
• First agent request

Out of scope:

• Workflow for getting the signed CA cert. This varies so widely from org to org that it's not meaningful to design a workflow for this.

Stretch goals:

• Workflow for putting the CA's cert in the right place (maybe a simple CLI)