I think checking `ca_current_name` is actually wrong.  There's no reason why the certificating authority should have the same identity - self-signed certificates are just the default but for a real deployment (once we enable TLS) we'd expect a real CA to be imported.