Only complain about weak SHA-1 signature algorithm for leaf certs if life-time exceeds three months (per Google advisory)