> Removing the root CA will mean that these valid certificates no longer work.

Great, that’s fine. They can reissue.