Native HTTPS, served directly by Bandit.
Erlang's :ssl reloads certificate files from disk, so a renewed cert is
picked up without a restart. The cert and key are declared as a pair: naming
one without the other is a misconfiguration worth a warning, while naming
neither simply means plain HTTP.
Files that do not exist yet are a separate, expected case — certbot has to complete its first challenge before they appear — so that degrades to HTTP with a log line rather than tripping this check.