The only winning move is not to play. AMI should never have distributed test certs to begin with. Give your customers instructions on how to generate self-signe

The only winning move is not to play. AMI should never have distributed test certs to begin with. Give your customers instructions on how to generate self-signed certificates (assuming they are accepted) or setup a dev CA that will sign test certificates. Then the damage from a key leak is limited to one vendor.