Document the CLI way to keep cert.cbor updated

[twifkak]

The main README should:

• Recommend regenerating the cert.cbor from cert.pem ~daily, so that it can pick up a fresh OCSP response.
• Recommend renewing the cert.pem every ~80 days.
• Recommend a tool for renewing with ACME. (Either verify that a popular CLI works with SXG certs, or write our own.)