it looks like they are doing automatic renewal of certificates, the only ones that customers have to do themselves is the ones the customers uploaded themselves
Which reads like the CA key got compromised - the customer's keys are fine
Which reads like the CA key got compromised - the customer's keys are fine