Instead of iterating through all users, we can look at certificate earners (`GeneratedCertificate` model).