I'm only worried about putting into the DB because we will probably want to store more nuanced information about how someone purchases certificates in the future, and a single boolean field doesn't seem to be flexible enough to handle that.

If it's only being used right now to see whether we should emit an upgrade event, I would vote for the cookie-based approach.