Try copying fedmsg certs using a nested var.

inventory/group_vars/badges-backend-stg

@@ -8,3 +8,12 @@ num_cpus: 2
 # the host_vars/$hostname file
 
 tcp_ports: [ 80, 3000 ]
+
+# These are consumed by a task in tasks/fedmsg_base.yml
+fedmsg_certs:
+- service: shell
+  owner: root
+  group: sysadmin
+- service: badges
+  owner: root
+  group: fedmsg

tasks/fedmsg_base.yml

@@ -37,3 +37,28 @@
   tags:
   - config
 
+- name: fedmsg certs
+  copy: >
+    src=$private/files/fedmsg-certs/keys/${item['service']}-${ansible_fqdn}.crt
+    dest=/etc/pki/fedmsg/
+    mode=644
+    owner=${item['owner']}
+    group=${item['group']}
+    service=${item['service']}
+  with_items: ${fedmsg_certs}
+  when: fedmsg_certs is defined
+  tags:
+  - config
+
+- name: fedmsg keys
+  copy: >
+    src=$private/files/fedmsg-certs/keys/${item['service']}-${ansible_fqdn}.crt
+    dest=/etc/pki/fedmsg/
+    mode=644
+    owner=${item['owner']}
+    group=${item['group']}
+    service=${item['service']}
+  with_items: ${fedmsg_certs}
+  when: fedmsg_certs is defined
+  tags:
+  - config