I think fundamentally, it is impossible to trust any entity forever. The best solution would be certificate updates outside of normal update paths. Its not like the format of x509 certs have changed in basically ever.

I suspect that protocol churn will settle down now. TLS 1.2 was introduced in 2008 and still considered ok, so its hardly that new now. Lots of people looking carefully hopefully means most of the issues have been flushed out.