> From the start, Let's Encrypt used a top-level certificate (known as a CA Root) that was signed by ISRG Root X1 and cross-signed by IdenTrust
Their "top-level" root is in fact ISRG Root X1. This was not cross-signed by IdenTrust (that wouldn't be impossible, several popular CAs took this approach, but ISRG, the people behind Let's Encrypt, did not).
The CAs which were cross-signed were the Let's Encrypt intermediates (sometimes called subCAs), so far these have been named Let's Encrypt Authority X1, X2, X3 and X4 and now just R3 and R4 (the name has to be sent over the wire every time you connect anywhere, and just "R3" is fewer bytes than "Let's Encrypt Authority R3")
[ Why are there intermediates? Well, an issuing CA has to be connected, albeit not directly, to the public Internet. That's obviously not the most secure situation conceivable. To protect the roots they can't be kept online, they usually live in dedicated hardware modules used only for relatively rare ceremonies like creating a new intermediate. Then the intermediates are kept online. If anything goes wrong it's relatively painless to distrust a mere intermediate, whereas distrusting a root causes massive disruption ]
Let's Encrypt provide a handy diagram:
https://letsencrypt.org/certificates/
Anyway, what changes in January is not anything about the certificates you actually get from Let's Encrypt. Not one byte. What changes is essentially metadata, starting in January the Let's Encrypt backend system will by default stop giving subscribers a chain of certificates that proves this can be traced back to Identrust's DST Root CA X3, and instead give you a chain that traces back to ISRG Root X1.
Your certificate is the same either way, for most people it will say it was issued by R3 (the shorter name I mentioned above, began being used at the start of December so many Let's Encrypt users haven't got a certificate from R3 yet but will do so automatically when next renewing). What changes is the accompanying certificate for R3 itself, there are two versions of that certificate.
If you need to service clients which don't yet trust ISRG Root X1 you can (tell your software to) continue to request the other version of R3 that's signed by Identrust's "DST Root CA X1" until later in 2021 when that expires.
But there is no change to the actual end subscriber "leaf" certificate and that's a mistake in the linked article.
I thought we might see a HN link for Let's Encrypt new intermediate R3 going live in the middle of the week, but we didn't. So I guess that means it went so well that nobody even noticed.