Comment by rentnorove

Wouldn't you want to validate it for the time at which it was served? In which case you'd just an archive of the CA roots at the time.