The no-certificates-issued point is the one people miss. A weak intermediate undermines the whole chain of trust below it, which is why blocking the intermediates first and then pulling the root from trust lists was the right escalation.