AFAIK the public and private keys of any keypair, like the intermediary, are always linked. You can not have a new public key with the same private key. But yo

AFAIK the public and private keys of any keypair, like the intermediary, are always linked. You can not have a new public key with the same private key. But you can always re-sign the same keypair from the root with a new, non-expired certificate. And since this keypair (the intermediary) signed all the individual add-ons to begin with, it will just magically work. Remember that certificate is nothing but a message that is signed by some "higher" keypair, which says that some "lower" keypair is trusted.