There may be some type of caching problem. When I visit https://marginalia.nu directly, I'm served with this cert, which does not include the apex domain: https://crt.sh/?id=6046506678

When I visit https://search.marginalia.nu I'm served with this different cert, which does include both wildcard and apex: https://crt.sh/?id=6125359537