HyperShift replace upgrades need bootstrap to generate the correct certs, and inplace requires the cert to be attached into the config (via the generation mechanism -> configmap in the HCCO). I think the latter case is already covered in the bootstrap flow

OnceFrom should also work as long as we attach the config when serving to the new nodes

There is one more use case: IBM uses firstboot-complete-machineconfig to write the full configs for their current use case. See this link: https://redhat-internal.slack.com/archives/C01C8502FMM/p1682971763192159?thread_ts=1682968210.631419&cid=C01C8502FMM 

We should try to not break that or help them move towards a working state