> b) if they need to revoke all of their certs (e.g. due to discovering a validation process failure) they don't miss any. Dumb q, but why not just revoke/inva

> b) if they need to revoke all of their certs (e.g. due to discovering a validation process failure) they don't miss any. Dumb q, but why not just revoke/invalidate the signing certificate used to sign the certificates?