(A related followup: Will `--deploy-hook` run if `/etc/letsencrypt/renewal-hooks/deploy/ntpsec` exists?. It could be that --deploy-hook doesn't work not because it fails validation but because I have at least one script in /etc/letsencrypt/renewal-hooks/deploy.)