Less a question more a comment, for future rollouts of this type, it would be really nice if the "high-confidence" value wasn't waiting until the month of the certificate expiration before being applied. While you have consistently stated "don't worry, we're handling it" it is worrisome to be less than 30 days out from the expiration and not having most of our devices (running new firmware versions, with the certs in place from those updates) running with the new certificate yet.

Additionally, the reporting from Intune only recently started working as well as the rollout of the settings catalog/config profile was plagued with 6500 errors.