Caramel tool runs OOM with large amount of duplicate certs

[Spindel]

So, due to lazy="subquery" we grab a lot of certificates from the backend, where we actually only ever want a single one.

This means that we would probably be better off using a dynamic query for .first() rather than using lazy load implementation to make a single join query.