A machine identity rotates and pooled outbound TLS sessions keep failing

The new cert is present, but long-lived pooled sessions still present the old binding context until the pool recycles.