This won't fix the legacy devices that already exist, but I wonder if there should be some way for root certificates to sign a replacement of themselves. All other signatures would be treated as invalid after the expiration, but this special "this is my replacement" signature would allow non-updated clients to continue to work.