I'll try and shop around for some other cert providers to see what's possible, but I'm pretty worried about the security token requirement messing with our GH secrets :S