At the moment, the automatic certificate management is done in a blocking manner:  https://github.com/bf2fc6cc711aee1a0c2a/kas-fleet-manager/blob/49ca377b2bc7368316653412721bd17e859355d5/internal/kafka/internal/services/kafkatlscertmgmt/kafka_tls_certificate_management_service.go#L80 
which can potentially block the reconciler depending on the time the calls to backing external service takes: in Stage we've observed certificate reconciling times of up to `20s` for some Kafkas: see reconciler times 

The certmagic library has an asynchrnous "ManageAsync" method which we could use.
But before we consider using this, we need to make sure that we do not send the Kafkas to the data plane if the Kafka doesn't have certificate already created: 

• this can be done either by ignoring all the kafkas that do not have the certificate in place and are in provisioning state
• finding a way to signal to the data plane that a particular managed kafka is in erronous state and it should be ignored: see the TODO comment on https://github.com/bf2fc6cc711aee1a0c2a/kas-fleet-manager/blob/5e6f90a4e64a128502bcbadaac076eeb9bd68481/internal/kafka/internal/services/kafka.go#L923