Probably everyone realised already, but when Apple email says

Your certificate will no longer be valid in 30 days. To generate a new certificate, sign in and visit Certificates, Identifiers & Profiles.

No need! Just go to Xcode Preferences > Accounts > Manage Certificates… > +

I’ve been doing what it says and messing about with the Apple Developer website and Keychain Access for years. The new flow with Xcode is about 100 times faster.