Currently cert-manager does create leases in kube-system namespace. This is the upstream default to prevent multiple cert-manager installations per cluster.
In out setup it's rater counter-intuitive because one has to know about this in order to be able to find the leases and might be mislead during debugging etc.
It's not safe to change the leader election namespace with a simple deployment as that would mean two elected leaders for a short period of time. So I propose changing .Values.global.leaderElection.namespace to cert-manager when updating the clusters.