Tap install — these are already signed and ready to sideload.
Something stopped working after a cert refresh? Email ipa@alcopawli.cc