<i>a</i> private key. It&#x27;s not uncommon to have multiple simultaneously-valid certificates for the same domain. I&#x27;d argue that it&#x27;s actually sort of irresponsible and therefore surprising for a site at the scale of Instagram not to, for backup purposes.