Retains the existing logging of orphaned certs until we are confident that this solution can fully replace it (even then we may want to keep it just for auditing etc). Fixes #3636.