Mixed comments in the github issue. I can definitely see how shorter lifetimes provide better security, but I have also run into my fair share of issues caused by cert expiry. Do we have good data around the lead time between someone’s signing keys being compromised and their use in an attack? The shorter that lead time the less useful this change is.