> If the intermediate is compromised you'll need to do a new key ceremony with the root to sign a new CRL, correct? You can use Validation Authorities to avoid

> If the intermediate is compromised you'll need to do a new key ceremony with the root to sign a new CRL, correct? You can use Validation Authorities to avoid needing the full on root that can issue new certs just to revoke an existing one. https://en.wikipedia.org/wiki/Validation_authority https://en.wikipedia.org/wiki/Validation_authority