Currently all users accessing a certificate activity can receive a certificate, including teachers and managers. I propose adding a new capability to control who can get certificates, and only assign it to students by default.