A buffer is used to ensure that we only remove certificates that are both expired and for which the buffer has past. Options allow removal from revoked/ and/or certs/.
