We should probably certlib.update much more often, it's very quick if nothing needs to change, and if something does need to change, it's generally better to get new certs, or get rid of old ones.  Probably not something for this patch, but I might add it somewhere (perhaps if entitlement ids reported in compliance differ from the system)