Can you be more specific on some of those main footguns? I need to rotate the CA for some rare reason. Boom, I do it. All the old SSH certs are invalidated, bu

Can you be more specific on some of those main footguns? I need to rotate the CA for some rare reason. Boom, I do it. All the old SSH certs are invalidated, but users can get a new one through the usual automated flow.