Nothing uses these certificates anymore, and nothing manages/renews them. Everything has either been converted to ACME, or fetches the _pyrocufflink.net_ wildcard certificate directly from the Kubernetes Secret.