Allowing bypass is the old way of doing things, and many non-browsers still allow it, so you should ideally hold on to old certs indefinitely, but at least for

Allowing bypass is the old way of doing things, and many non-browsers still allow it, so you should ideally hold on to old certs indefinitely, but at least for a short while.