A Route53 health check string-matches `certificates.worst` in the body of `GET /health`, and a CloudWatch alarm in us-east-1 reads that check, so a zone whose renewal has climbed above `ok` and a server that stopped answering both raise it. `alarm_sns_topic_arns` is where an operator's topic goes. Change-Id: I1c7677c0d25773b982926af480ef16b386336dab