tasks/ssl: only revoke certificates that we have signed