The server protocol for this is
:<uid> ENCAP * CERTFP :<40 hex chars>
both in new user introductions and in burst.
As in oftc-hybrid, only the user themselves and opers can see the certfp.
Displaying the certfp on connect seems unnecessary to me,
the user can whois themselves if needed.
Use /quote help who for details.
The format code "o" (oplevel) is not documented,
but implemented showing dummy information (999 for
chanop, n/a otherwise).