Why would you pin a certificate that you did not generate for a domain that's not yours?
This usually happens beacuse some applications don't use by default the root CA bundle of the underlying OS to authenticate TLS connections, but require you to put each Root CA certificate in a trust store (ex. Java).
Some devs probably added just the Digicert root CA and forgot about it.
These kind of changes with certificate are always kind of tricky, because they usually work very reliably until they don't.
All of this is assumption based on how they seem to buy enough compute at Heroku to have sway over rolling back this change of cert provider.
Some people despite the warnings and consequences can't help themselves :)
1) people are dismantling goods, then ringing for advice but being embarrassed they broke it, then rebuying when we refuse advice,
2) tell people not to dismantle it, they'll get curious and do the opposite,
3) ...
4) pro-fit!