Just 3 questions:

• Will we need to update the WinPE build media and Windows Install Source Images if the device has the new certs installed (or the old have expired)?
• Will the Windows Install process update the Certs if the Windows Install source media has been updated and the device has not?
• Will any future cumulative patches that require new certs for a security vuln patch also force the upgrade of the cert if the device has yet to be updated?