Fix consequence of certification loss (!181)

* detail the rest of identity removal

* instead of removing the identity, expire it

* reveals what happens when a certification expires