Similar to what we do for the main Wikimedia project TLS certs, the main *.toolforge.org and *.wmcloud.org certificates feel critical enough that we should get a second pair of certificates to always have as a standby in case of issues with the primary CA (currently Let's Encrypt). The main project certificates use GTS for this purpose which seems like a good option for us as well.