deployment-acme chief hosts have non-canonical-redirect-* certificates, for example those for wikipedia.com. Of course it can't update the DNS records for those but it shouldn't even try since we don't serve those in the beta cluster.