We take advantage of group_by to create the list of nodes needing new certs, instead of manually looping inside a Jinja template. This should make the role more readable and less susceptible to white space problems.