Entitlements from derived product pool not able to get upstream

The subscritption id is not on the stacked pools that are created for derived products.
The entitlements for those pools do not allow Thumbslug use as the upstream
cert comes from the subscription.
I think there might be a date issue here. Previously this API call was made when something was using an entitlement cert against thumbslug. Now however it looks possible that the stack might include some future entitlements, which could cause us to return a cert here that isn't usable. Probably just need to iterate below until we find one that's currently valid.