docs: def extract_subject_from_dn(cert_obj):
      """Serialize a DN to a DataONE subject string.
  
      Args:
        cert_obj: cryptography.Certificate
  
      Returns:
        str:
          Primary subject extracted from the certificate DN.
  
      The certificate DN (DistinguishedName) is a sequence of RDNs
      (RelativeDistinguishedName). Each RDN is a set of AVAs (AttributeValueAssertion /
      AttributeTypeAndValue). A DataONE subject is a plain string. As there is no single
      standard specifying how to create a string representation of a DN, DataONE selected
      one of the most common ways, which yield strings such as:
  
      CN=Some Name A123,O=Some Organization,C=US,DC=Some Domain,DC=org
  
      In particular, the sequence of RDNs is reversed. Attribute values are escaped,
      attribute type and value pairs are separated by "=", and AVAs are joined together
      with ",". If an RDN contains an unknown OID, the OID is serialized as a dotted
      string.
  
      As all the information in the DN is preserved, it is not possible to create the
      same subject with two different DNs, and the DN can be recreated from the subject.
  
      """
      return ",".join(
          "{}={}".format(
              OID_TO_SHORT_NAME_DICT.get(v.oid.dotted_string, v.oid.dotted_string),
              rdn_escape(v.value),
          )
          for v in reversed(list(cert_obj.subject))
      )