This reverts commit 59f558bd.

- api.turris.cz use certificate from internal autority
- api2.turris.cz does not exists
- (www.)turris.cz is just a public human-readable web presentation

That one is no longer used.

The current one will expire rather soon, so generate a new one and
accept it once we switch.

The key is, obviously, not here.

Make sure the script fails when something can't be downloaded. Also make
sure the old file is not overwritten in such case.

Store just one certificate (the new one), since nikola can not handle
multi-certificate files.

Store the correct one ‒ we had two copies of the old one previously.

And don't fail the script if it doesn't download. This way we can keep
using the old one at least until it times out.

At least for now. We want to download and generate it on the spot in
future and renew it.

This is equivalent to revocation in our case.

We need to rotate it