> b) if they need to revoke all of their certs (e.g. due to discovering a validation process failure) they don't miss any.

Dumb q, but why not just revoke/invalidate the signing certificate used to sign the certificates?