Reload certs between retries

[mcpherrinm]

I think we only reload certs when we start a sync.

But if a client cert is invalid (eg, expired), there's no point in retrying with the same cert.

We saw this after a host had its renewal fail to happen on time, and then once we kicked the renewal, keysync still failed until it gave up retrying. We could have cut down the failure window here.