Hi SebastianKIT​,

DBX is for explicit revocations in case of compromise or similar. That is not the case here and is part of this process. Adding the old certs to DBX would cause all current boot critical components to become untrusted making the system unbootable. We would need to update every boot critical component to re-sign it on all in market OS versions which would be an even greater logistic nightmare and would add not true value. Ultimately, both certs of certs will remain trusted and there isn't an explicit reason to ever change this (unless a cert is compromised as noted).