Presumably updating "ca-certificates" nuked some cert that these old devices require. Perhaps I can put it back and make them work again, but I have no idea how to figure out which one it is. Any suggestions?
The ones that stopped working are: iPad mini Gen 1, 2012, iOS 9.3.5, MFL432LL/A or MD531LL/A.
(Also, we can always give a good home to old iPads. Maybe not quite this old, though.)