Make sure the script fails when something can't be downloaded. Also make
sure the old file is not overwritten in such case.

Store just one certificate (the new one), since nikola can not handle
multi-certificate files.

Store the correct one ‒ we had two copies of the old one previously.

If it is installed and enabled.

Closes: #3610.

to ask it to run right away now, not waiting random time. It will be
used by updater under some circumstances.

And don't fail the script if it doesn't download. This way we can keep
using the old one at least until it times out.

With extra check to see if it actually resolves.