Grafana data source TLS: limits of CA certificate reloads and DNS caching without restart

Goal

I am operating Grafana (assume a current LTS release) with several provisioned data sources (Prometheus and Loki) that use TLS with a custom CA supplied via tls_ca. I want to understand the operational limits of certificate validation and DNS resolution for these connections, specifically around rotation and failover scenarios.

Constraints and uncertainty

My understanding is that Grafana validates data source certificates against the system trust store unless tls_ca is set, and that hostname resolution depends on the host OS resolver plus Go HTTP client connection reuse. Two behaviors are unclear to me: whether updating the CA file referenced by tls_ca takes effect without restarting Grafana or re-saving the data source, and how long stale DNS answers can persist for a data source hostname after the record changes, given TCP connection reuse.

Questions

• Is there any supported mechanism (API call, provisioning reload, or signal) that makes Grafana pick up a changed tls_ca file for existing data sources without a full restart?
• Does Grafana's HTTP client honor DNS TTLs for data source connections, or can pooled connections keep using an old IP indefinitely until restart?
• Is certificate revocation checking (CRL/OCSP) performed at all for data source TLS connections, or is it entirely out of scope?