There's unfortunately a lot of nuance and sadness here. Generally, a root is trusted by virtue of being in your root store and can't be revoked via OCSP/CRLs.

There's unfortunately a lot of nuance and sadness here. Generally, a root is trusted by virtue of being in your root store and can't be revoked via OCSP/CRLs. An operating system security update should remove distrusted roots. The mainstream browsers all have a push-based mechanism that they can use to rapidly revoke a root or intermediate faster than that. If something truly bad happened, Let's Encrypt would ensure that happened ASAP. However, many clients do no revocation checks at all. That's a big part of why the ecosystem is pushing to shorter lived certificates, intermediates, and roots.