How do you prevent valid certs from being sold?

Sold by whom? The created cert can be time limited and single use, so the service couldn't really sell them. You could rate limit how many certs users can create and obviously make it illegal to share them in order to deter people from using them. That's not enough to prevent it completetly, but should be an improvement for the use cases I hear the most about: social media (because it reduces the network effect) and porn (because kids will at least know that they're doing some real shady shit).