tldr: new TLS certificate is stuck in the pipeline for a few days, because onion certificates are special and weird: https://twitter.com/AlecMuffett/status/1205443143816110085?s=19 (Includes links to sources)