cert-manager decisions: why the code looks like this