fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.

debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py

@@ -938,11 +938,14 @@ def status(cfg):
     warnings = []
 
     def crl_of(name):
+        """The next update of the CA's CRL; a CRL the router signs warns once past half of its validity, which the timer
+        renews before, and one signed offline WARN_DAYS before it expires."""
         crl = read_crl(directory(name) / 'crl.pem')
         following = utc(crl, 'next_update') if crl is not None else None
+        signed_here = (directory(name) / 'key.pem').is_file()
         if crl is None:
             warnings.append(f'{name} has no CRL')
-        elif following is not None and following <= soon:
+        elif following is not None and (crl_stale(directory(name) / 'crl.pem') if signed_here else following <= soon):
             warnings.append(f'the CRL of {name} {"expired" if following <= moment else "expires"} on {iso(following)}')
         return iso(following) if following else None