[SDK] client_certs.py has had no callers since #79 and is the only reason cryptography is a dependency #155

centml/sdk/utils/client_certs.py (93 lines) generates a CA/client certificate
triplet for private endpoints. It has had no callers anywhere in this repository
since October 2024, and it is the only reason cryptography is a dependency.

How it got here

$ git grep -n "client_certs\|generate_ca_client_triplet\|save_pem_file\|CAClientCertTriplet" -- . \
    | grep -v "^centml/sdk/utils/client_certs.py:"
(no output)

Not mentioned in the README, not exported from centml/sdk/__init__.py (which
is from platform_api_python_client import * plus from . import api, auth), no
CLI command reaches it, and the 119-test suite never touches it.

Why it matters

It is the sole importer of cryptography in the package:

$ git grep -rn "^from cryptography\|^import cryptography" -- centml/
centml/sdk/utils/client_certs.py:6:from cryptography import x509
centml/sdk/utils/client_certs.py:7:from cryptography.hazmat.primitives import hashes, serialization
centml/sdk/utils/client_certs.py:8:from cryptography.hazmat.primitives.asymmetric import ec
centml/sdk/utils/client_certs.py:9:from cryptography.x509.oid import NameOID

auth.py calls jwt.decode(..., options={"verify_signature": False}), which
does not need it.

So the hard pin cryptography==50.0.0 in requirements.txt exists entirely for
this module, and the maintenance it generates lands on everyone:

• two open high-severity Dependabot alerts for GHSA-g6cj-pr64-35w5 (one per
  manifest) were about a PKCS#7 API this package never calls
• Bump cryptography from 48.0.1 to 50.0.0 #147 bumped the pin to close them
• [SDK] Stamp generated certificates with aware UTC datetimes #154 replaced its deprecated datetime.utcnow() calls

Because the pin is ==, a user whose scanner flags the advisory cannot upgrade
cryptography in their own environment without a resolver conflict with us.

Dropping the module would drop the dependency — and cryptography is this
package's heaviest install, carrying compiled artefacts.

What needs deciding

Is private-endpoint certificate generation coming back? The caller was removed
as part of the platform API upgrade, so this is a product question rather than a
cleanup one.

If it is not coming back, removing the module and the cryptography requirement
ends a recurring maintenance stream. One caveat: the module ships in the wheel,
so anyone importing centml.sdk.utils.client_certs directly would break. It is
not a documented surface, but it is an importable one.