My plan for dbupdate is to run it from the _weekly_ script (since TZ
updates have historically always had at least 1 week heads up even from
the most retarded governments), and I suspect this will also cover
problems with certs quickly enough.

Users can always run it manually themselves, in which case the weekly
run will notice it does not need to do the large download operation.
On that matter:

I am not seriouslyu concerned about having all openbsd machines in timezone
stripe hitting downloads for (typically) a single file at the same time,
if I change it to use cdn.openbsd.org

I am considering whether the installurl mirror should be used, or if
it we should make it use the cdn (for the potential pressure)...

Maybe try to use the cdn first, failover the installurl.  It is possible
someone will run an underbuilt mirror because too many users end up
pointing at it without them knowing.  The cdn is much better prepared
to handle this.