Certified defences can hurt generalisation