Use KeyChain instead of Credentials to delete certs

Credentials is a bit too low-level. KeyChain will call into the same API
but also arrange deletion of grants, send out STORAGE_CHANGED broadcast
and anything else that might be needed in future.

Bug: 27335182
Change-Id: I764ffa3c5539ddec2b9a776bd3fec6a78a043248