Add staging to CA certificate checker

Also show which certificate each URL needs

Also warn when overwriting an existing certificate (even though git
knows).