That then raises the issue in my first two comments, we lose track of certificates of existing hosts.  This is less surprising, as existing certs continue to work and Foreman can delete them (as we continue to track them), but then sign new certificates as per the current value of the setting.