Correct. It is a GlobalSign cert that was donated to the Node.js project. Once we became a company we had to stop using it, both from an abundance of caution, security wise, since we were not the only ones who had the cert, but also because it wasn't right to be using a free cert for our new, for-profit entity.

But moving to our new, self-owned cert in a way that broke anything was avoidable, and a huge error on our part.