It looks like it should be issuer-kind (not just kind) but I've tried that and I've also tried with just 'cert-manager.io/cluster-issuer'. It seems like the annotations are ignored. I'm not sure where I can verify them. When I look at the ingress, they're not reflected there.