The solution was Let’s Encrypt root cert expiration as identified in this post by @teocomi / @dimitrie
Looks like this wasn’t entirely our fault? For once.