The answer was twofold:
1. the ledger wasn't big enough. I didn't properly grasp what managedLedgerOffloadAutoTriggerSizeThresholdBytes actually describes.
2. by using a k8s initContainer to install a single custom cert, we were accidentally overwriting the JVM's cert.