Since in upstream we are not using private registries the cert-manager should be installed based on public catalog sources. As soon as this task is done https://issues.redhat.com/browse/OSP-28029 we will lost the ability to use the readhat-operators catalog source, that needs the pull-secret to be in place and that now works cause it's image is pulled before the pull-secret is gone.