improve logic for toggling letsencrypt mode

[OlofBlomqvist]

when toggling a site between using letsencrypt or not, we do not remove or otherwise prevent previously generated LE certs from being used. i think keeping the certs is fine but we should make sure to remove them from any mem cache and verify that we only use self-signed ones unless opted in to LE