Fresh evidence has emerged that stolen web security certificates were being used to spy on people in Iran.