I have closure on this and am adding this post for posterity.
After a dialog with the developers in Tracker, I removed all the restrictions on the certificate and saved. Then I added them all back, just as before. Now it works. The developer clarified that the patch does not go back and retroactively fix existing restrictions. So to take advantage of the patch in existing systems the restrictions must be removed and then recreated.