Assume each site makes one certificate issue request per month: 146 * 10^6 / (30 * 24* 3600) ~= 56 reqs/sec. Maybe double or triple the number to account for office hour-related peak hours.

I don't even think sharding would be required to handle that, strictly speaking. A single medium-to-high end machine could probably handle billions of sites this way, assuming everything has been done right (I assume it has).

I do however think a lot work has to go into:

a) developing/documenting client tools

b) developing/maintaining the server codebase

c) developing/documenting/maintaining security protocols

d) devops for the server(s) doing the key signing

e) devops for maintaining security, according to the protocols developed

and so on...