Following the manual was exactly the problem
Internet.nl measures whether your domain has IPv6, DNSSEC, RPKI and TLS right. Doing that for a whole fleet needs the batch API, and the batch API needs an account. You can host it yourself — but one variable in the official manual silently kills all outbound traffic, and the certbot in the image cannot even start, so your certificate expires with nothing raising an alarm. Four traps, with the exact error strings, and what they say about documentation that is technically correct.