Shorter certificate lifetimes

[mnordhoff]

@bytecamp

The certificate itself is public in any way (you may download it on https://crt.sh/), the private key must be kept safely. If the key gets exposed, you can revoke a certificate at any time.

Revocation isn't very reliable, though.