if err != nil {
				logger.Fatal(err, "Failed to load KES client certificate")
			}
			certificate.Watch(context.Background(), 15*time.Minute, syscall.SIGHUP)
			certificate.Notify(reloadCertEvents)

			kmsConf = kms.Config{
				Endpoints:        endpoints,
				DefaultKeyID:     env.Get(kms.EnvKESKeyName, ""),
				Certificate:      certificate,
				ReloadCertEvents: reloadCertEvents,