Looking at crt.sh (https://crt.sh/?q=cdn.winget.microsoft.com https://crt.sh/?q=cdn.winget.microsoft.com), it seems that the certificate is issued automatically

Looking at crt.sh (https://crt.sh/?q=cdn.winget.microsoft.com https://crt.sh/?q=cdn.winget.microsoft.com), it seems that the certificate is issued automatically anyways but for some reason the updated certificate is not applied correctly. A bad screwup really, but more of did someone forget to check their logs for deployment errors rather than the common case of someone forgetting to manually update the certificate.