https://www.flathub.org is using Let’s encrypt. Their certs only last 90 days so you need a script to make sure they are updated and pushed to your site. https://flathub.org uses Globalsign which lasts for 13 months. My guess is they don’t have a process for reconciling the two types of end dates.