```release-note:improvement
secret/pki: Add `revoked_safety_buffer` to control retention on revoked certificates separately from expired certificates. 
```