Current brand installer was written with assumption it would only a list of the certs that were just installed.
Mostly to avoid having to sort out expired or otherwise bogus ent certs, but if it runs in perform() after the missing_serial install and the rogue_serial delete, that should be okay. 

I think what stopped me originally was concern about the gui case, where ent certs get updated, and
would hit the brand installer, and then potentially hit it again with the ent/prod dir watchers. If we could 
find a way to avoid that nicely, then running brand installer on any cert dir change would be nice. It means 
a few more trips at least through the brand installer, but, at least at the moment, that is pretty quick.