I wasn't writing to the update process, as much as the original installation of a cert.

On a house you own, you can change locks and keys any time you want to keep security up to date (for example).

no house in "move in ready condition" comes without sufficiently keyed door locks of some kind (on day1).