refresh_command should not be triggered if "*.crt" file is unchanged, but "*.key" file is missing

It seems like it would be best practice to delete the "*.key" file after it is processed to help prevent private key abuse.

So when the provider checks if a certificate has been updated, it should only compare the "*.crt" file when considering if an update has occurred. A missing "*.key" file should be tolerated.

Unless I'm misunderstanding the process, when the cert is renewed, its "*.crt" file is going to change. There should be no need to continually expose the private key. At the very least, an option should exist to skip checking the "*.key" file.

No file or test is named in the issue. Start by locating the certificate comparison and refresh_command path; verify that an unchanged *.crt with a missing *.key does not trigger a refresh, while a changed certificate still does.

Written by the indexing model from the issue text.