The problem is that sysadmins don’t want to actually fix there setups to make certificate rolling easy. And every single time there’s a compromised or busted

The problem is that sysadmins don’t want to actually fix there setups to make certificate rolling easy. And every single time there’s a compromised or busted CA, or some certificate flaw, these same incompetent sysadmins get up in arms about how they cannot possibly perform one of the most basic and fundamental tasks of running connected services in less than a week. This is a task that should be almost entirely if not completely automated, and should take in the order of hours. This is their own fault. They’ve had well over a decade of knowing they had to fix this fundamental failure in their systems and they did nothing. That this change is a problem demonstrates incompetence. if it’s actually surprising (and it’s not just “we bitched before and it worked”) then they’re actually literal morons: this has been best practice for over a decade and repeatedly and clearly stated as what the future was going to be. This change is not new.