Replace Asterisk's self-signed PJSIP TLS certificate with a trusted Let's Encrypt cert, using a certbot deploy hook to keep it renewed automatically.