pub(crate) async fn prepare_signer_material(ca: &CaConfig) -> Result<(), String>Expand description
Renewal runs before startup and every generation; an invalid replacement must never reach bundle publication. Valid external renewals need no command.