We’ll need to manage the cert ourselves I think due to the usage of pkg.

Is that true if pkg is behind a CDN? (maybe you did that)