Branding is updated when product certs change while the gui is running, but never when entitlements are removed?  Perhaps branding should be updated in UpdateAction.perform(), if there are missing_serials or rogue_serials.  That way when one of my two branded certificates expires, it attempts to brand based off the other.