I've added some information on why we made the choices we did in the Discussion section. Briefly, the GCP managed certs are only available with the native GKE load balancer solution. For costs reasons, we use nginx-ingress rather than the native solution.