At a minimum, some query that can return a list of certnames whose catalogs mention any one of a provided set of inputs.
Inputs would be returned under a new optional key in the catalog response. Whether or not we'll want/need to make that field opt-in is as yet undetermined, but our versioning policy does require clients to ignore unexpected new fields, so we're not obligated to make it opt-in, nor to increment the endpoint versions.