If it's for SSH, you should be able to blacklist that particular certificate. You want to do this to revoke access anyway. Only downside is an every growing bla

If it's for SSH, you should be able to blacklist that particular certificate. You want to do this to revoke access anyway. Only downside is an every growing black list file, but that is probably a problem you need centuries of use to actual need to solve.