Maybe I am saying something stupid, but infrastructure services should be able to use a dynamic set of keys. If the first doesn't work, you try the second, and

Maybe I am saying something stupid, but infrastructure services should be able to use a dynamic set of keys. If the first doesn't work, you try the second, and then the third and so so. Similarly the clients, we should be able to dynamically adds certificate. Our own key expires and our services are all about to drop connection seems something that should not happen.