certctl(8): let one blacklist based on hashed filenames

It seems reasonable to allow, for instance:

$ certctl list

reviews output -- ah, yeah, I don't trust that one

$ certctl blacklist ce5e74ef.0
$ certctl rehash

We can unambiguously determine what cert "ce5e74ef.0" refers to, and we've
described it to them in certctl list output -- I see little sense in
forcing another level of filesystem inspection to determien what cert file
this physically corresponds to.