Under this scenario you wouldn't need to do anything if the site rotates their key - the new key would be presented with a certificate signed with the same CA k

Under this scenario you wouldn't need to do anything if the site rotates their key - the new key would be presented with a certificate signed with the same CA key. But no clients support doing this kind of semi-automated enrollment at the moment. You can manually add the trusted certificate to known_hosts, though.