Doesn't the /internal/ still make sense? There's constantly strong pressure on //net to commit to a public/private API, and I think for significant portions of /cert/internal, we don't want this to leak beyond the abstraction provided of, say, CertVerifier.

If we keep the internal/ structure we will need to address:

 * Adding public APIs for stuff used outside of //net (like the entry points used by Cast which currently call into cert/internal/*)

 * Separate public API for stuff consumed elsewhere by //net (like parsing primitives), or just dive into cert/internal?

 * Normalize inconsistencies between code in cert/* and cert/internal/*

I would think //net is fine to use //net/*/internal, but things outside of //net should be given abstractions which reflect what we're comfortable exposing (e.g. not footguns)