is it possible to wait for a cert-manager certificate secret to have the cert keys filled in? how would one go about it?

You should be able to do this with a Promise (something like https://github.com/pulumi/examples/blob/master/kubernetes-ts-staged-rollout-with-prometheus/util.ts#L32-L43) or using dynamic provider as described in https://www.pulumi.com/blog/dynamic-providers/#dynamic-providers-as-provisioners

this is very helpful, thanks @gorgeous-egg-16927