Certificate transparency & re-key log

TLS hubs (adcs://) are identified by their certificate keyprint. When a listed hub begins presenting a different keyprint, we pause publishing its keyprint and record the change here. A re-key is routine, but an unexpected change can indicate a man-in-the-middle — owners confirm a legitimate re-key out-of-band.