Those two extra staff are expensive, but worth it.
(I know you're joking)But even if they're costly, if they keep the service running and bring in funds, why would anyone risk damaging their business and start cutting costs ?
The case problem was that the software was running on MS-DOS, had a janky text-based interface, but managed to work well for Zara's fast-fashion inventory.
The 'right' solution for the case was to not change anything at all.
I find it hard to believe that any business would not benefit from moving from an ancient computer system to one with error validations and better tooling so that their boots on the ground can make less mistakes. Forget the cost of transitioning since at scale that's a whole executive job function, but purely from a day-to-day I don't understand how what you said can be true.
Even passenger jets still use floppy disks. AFAIK Zara did update their POS system later though, to be more compatible with payment device hardware.
Assume each site makes one certificate issue request per month: 146 * 10^6 / (30 * 24* 3600) ~= 56 reqs/sec. Maybe double or triple the number to account for office hour-related peak hours.
I don't even think sharding would be required to handle that, strictly speaking. A single medium-to-high end machine could probably handle billions of sites this way, assuming everything has been done right (I assume it has).
I do however think a lot work has to go into:
a) developing/documenting client tools
b) developing/maintaining the server codebase
c) developing/documenting/maintaining security protocols
d) devops for the server(s) doing the key signing
e) devops for maintaining security, according to the protocols developed
and so on...