With SSL certificate lifetimes shortening dramatically, how are folks dealing with certificate management with Puppet? We're going to be using ACME (certbot), and I'm working on a scheme to get managed applications requesting a certificate via an exported resource that can be collected by the certbot profile, then copied to our Puppet server to be published by a fileserver mount, but that seems a bit clunky especially since we'll be having expected catalog failures if the requesting catalog runs again before the new certificate can be fetched and published