I figured as much, my knowledge of X509 certs ends at knowing "generate a CSR, get it signed, install it" and operating a couple Dogtag CA's as part of FreeIPA.

I figured as much, my knowledge of X509 certs ends at knowing "generate a CSR, get it signed, install it" and operating a couple Dogtag CA's as part of FreeIPA. Having a secondary cert ready to be swapped out with an Ansible playbook (or whatever your tooling of choice is) and ensuring both intermediate roots are pinned seems to be the best way to handle this then. Good to know!