Which keys and certificates we have to keep safe?

yes they can…
but till the kes period - after that you need to create a new node cert, but that method need the keys…
https://docs.cardano.org/projects/cardano-node/en/latest/stake-pool-operations/KES_period.html
Also if you register a new cert then the previous one will deactivated automatically as this post suggests: VRFKeyWrongVRFKeyOVERLAY, couldnt mint our block - #18 by Triton-pool