Make endpoint CA available at {{ provider_domain }}/ca.crt

Sync riseup changes to lilypad.

There were other changes that were local but those were only necessary for the transition from the old platform to the new one, and were specific to the provider's config.