Reorganizing the repo structure to match the plan. Apparently, git filter-branch was not necessary to remove certificate's private key because someone had already run it. At least, git log --diff-filter=D --summary | grep delete does not show any private key.