I think you're right about the lock needing to happen here.  The order of the statements needs to be flipped to grab the lock based on the certname in the metadata table.  I'm not locking individual facts (i.e. new facts could come in mid transaction) I'm locking ALL facts for a given cert, including preventing new facts from appearing, until the update is done.