ACME clients should write the private key and certificate to a temporary file, then move it to the final destination so that the change is atomic.
open takes a file path and gives you back a fd that doesn't know anything about fs paths (it tracks the underlying inode).
Thus, nginx may open(key) before the directory is renamed, and open(cert) afterwards. The first fd is now pointing to the old key, while the second fd points to the new cert.
Another comment pointed out though that most of the time you only need to update the cert, and not the key. So it's mostly a moot issue..
Edit: it does. Just use that instead of messing with separate files