Log expiry events, and, for user policy, only show expiry notifications when the percentage of remaining certificate lifetime ...