Replacing the TLS certificate and key on a running Vault cluster without requiring a restart/unseal