Are 389-day certificates really that much less concerning from a censorship perspective than 47-day ones? Also, DNS is already much more censorable than the Web PKI, so I don't see how increasing reliance on the latter makes things worse.