Make sure the script fails when something can't be downloaded. Also make
sure the old file is not overwritten in such case.

Store just one certificate (the new one), since nikola can not handle
multi-certificate files.

Store the correct one ‒ we had two copies of the old one previously.

And don't fail the script if it doesn't download. This way we can keep
using the old one at least until it times out.

At least for now. We want to download and generate it on the spot in
future and renew it.

This is equivalent to revocation in our case.

We need to rotate it

From a real authority now.