New certificate download code breaks autosigning workflow

Autosigning appears to be broken with the new certificate download code (PUP-8652). When using an autosigning workflow, the first agent run fails with

Error: Could not request certificate: Error 400 on SERVER: pto1to2xvyajwdw.delivery.puppetlabs.net already has a signed certificate; ignoring certificate request

It seems that the agent is re-submitting a CSR even though it has successfully downloaded the signed host certificate. This could be related to some weird interaction between remaining indirector code and the code.

This issue appears to be affecting both Puppetserver's beaker acceptance tests (whose pre-suites use autosigning to set up their environment) and PuppetDB's clojure integration tests.