ensure we have a plan for CA rotation

sub task of #71

Edited by sgk
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information