Ah you're right. I was imagining that folks would get their certs from an out-of-band flow. Welp, there's no reason to expect that. This is why I don't do security, I suppose. Whoops.