Provision both tc certs before the app config.
Treat theconversation.com as the canonical tc cert.
Select the correct cert based on env, to support the real staging cert.