Using port 443 for renewal after TLS-SNI is disabled

Yikes. If pip uninstall doesn't do anything very special, maybe just delete the stuff with rm?

(Or mv!)

There should already be a cron job in /etc/cron.d/certbot. (But it doesn't run.)

And the systemd timer.

You should delete your own cron job and configure a hook to handle reloading Nginx, or disable the other two. Having them all running is kind of problematic.

Yeah... If you switch to another ACME client at least you don't have to be careful about breaking Certbot...