Fix RootCaRotationPoller not toggling rotation if previous rotation failed

Currently when rotating certificates through DefaultCertificateClient's CertificateRenewerService it hides all errors from the outside. RootCaRotationPoller needs to know at least if the cert signing resulted in an error so it can retry again after the interval passed.

CertificateRenewerService needs better retry mechanisms, but it's not scope here.