When try the command Add-TrustAuthorityKeyProviderServerCertificate, it will meet the error of "com.vmware.vcenter.trusted_infrastructure.cluster.inconsistent_state"
The external update of the KMS certs may cause inconsistency in server certificates configured on different trust authority hosts. And the cluster will be treated as inconsistent state under such condition, then some server certs related command (like Add-TrustAuthorityKeyProviderServerCertificate) may fail.
Fix the server certificates on the trust authority hosts, reconfigure them to make them consistent.
Run Get-TrustAuthorityKeyProviderServerCertificate command to get current server cert of the current key provider, and then use Set-TrustAuthorityKeyProviderServerCertificate command to set the obtained certs to the trust authority hosts.