[zeroimpl]

You don't need to keep a master list of IP addresses up to date, you only have to test an IP when a request for a cert comes in from that IP.