The alert fires days before expiry, but acme_chief handles renewals automatically and the cert should renew on time. We shouldn't encourage the already-present alerting overwhelm/desensitizing situation, so we should only fire when things fail and need to be looked at.

<bblack> IIRC the math involves LE and Google, too, because I think we poll them and they tell us when to renew
<bblack> but still, they document the timeline and any random variance, I assume, and we can tune our alert to the limit

What is this math and how can we better calculate/provide padding so that we don't alert prematurely?