ACME / Let's Encrypt go in the direction of making expiry happen so often that renewal gets automated, rather than a being a rare manual process that can be forgotten about.
Not sure that's viable for a signing certificate like this, but that's the way to solve it for the web PKI.
Not sure that's viable for a signing certificate like this, but that's the way to solve it for the web PKI.