got := map[string]Expected{}
			for _, scrt := range raw {
				got[scrt.Name] = Expected{
					Key:    string(scrt.GetTlsCertificate().GetPrivateKey().GetInlineBytes()),
					Cert:   string(scrt.GetTlsCertificate().GetCertificateChain().GetInlineBytes()),
					CaCert: string(scrt.GetValidationContext().GetTrustedCa().GetInlineBytes()),

					secret := &tls.Secret{}
					if err := rr.Resource.UnmarshalTo(secret); err != nil {
						istiolog.Warnf("failed to unmarshal secret: %v", err)
						continue
					}
					if secret.GetTlsCertificate() != nil {
						secret.GetTlsCertificate().PrivateKey = &core.DataSource{
							Specifier: &core.DataSource_InlineBytes{
								InlineBytes: []byte("[redacted]"),
							},
						}
					}