Make CertificateProviderService vend ClientCertIdentities directly.

chrome/browser/certificate_manager_model.cc

Index: chrome/browser/certificate_manager_model.cc
diff --git a/chrome/browser/certificate_manager_model.cc b/chrome/browser/certificate_manager_model.cc
index d3c3ebf3e714312ef91b10bf3b8d1d8107bf6933..dccc43692c2808b20ddc06dbd13331e5878f6f5f 100644
--- a/chrome/browser/certificate_manager_model.cc
+++ b/chrome/browser/certificate_manager_model.cc
@@ -143,8 +143,10 @@ void CertificateManagerModel::RefreshSlotsUnlocked() {
 }
 
 void CertificateManagerModel::RefreshExtensionCertificates(
-    const net::CertificateList& new_certs) {
-  extension_cert_list_ = new_certs;
+    net::ClientCertIdentityList new_cert_identities) {
+  extension_cert_list_.clear();

[Lei Zhang, 2017/06/16 23:03:24]

Is the size of |new_cert_identities| typically large enough that it would help
to reserve(new_cert_identities.size()) before the for-loop?

[mattm, 2017/06/19 21:21:02]

Hm, probably not usually, but wouldn't hurt.
Done.

+  for (const auto& identity : new_cert_identities)
+    extension_cert_list_.push_back(identity->certificate());
   observer_->CertificatesRefreshed();
   DVLOG(1) << "refresh finished for extension provided certificates";
 }