Each mirror can have its own cert with its own private key. After all, they each have their own DNS name. Really, the issue is convincing all mirrors to migrat

Each mirror can have its own cert with its own private key. After all, they each have their own DNS name. Really, the issue is convincing all mirrors to migrate when they have the simpler issue of turning of a mirror.