By far the most logical default behavior to me is that if the issuing CA was valid and trusted when the cert was issued, the cert should be considered valid until it expires. This of course means you need a trusted timestamping service or I guess CT can fulfill the same purpose.

For CAs who get distrusted due to reasons which imply their issued certs might not be trustworthy, either revoke the certs individually or use a separate "never trust" list.