Comment by josephcsible

> A flat cert.pem file (or similar) can't say "distrust this intermediate".

Why does that matter in this case? Can't this be fully mitigated with next to no collateral damage just by removing the trusted roots that signed them?