This is probably more of a "we'll need another hook" comment, but one of the upcoming reqs will require us to detect a new cert coming down that wasn't actually subscribed to from subscription manager itself, in which case we'd probably need a separate "post certificate downloaded" hook.