Interesting. certlib.UpdateAction should probably have some slots in it. .install() in particular. That should handle the case where we get new certs that werent subscribed to from subscription-manager directly.