Thanks for your feedback.
A more appropriate way to deal with this would be to state that there will be a 30 day consultation period for every change, and if you do identify a "critical issue", to revoke every certificate and have everyone re-agree to it.
Now, I know you don't want to do that because if you do find a critical issue, solving it that way makes everyone mad at you, but here's the thing: that's how it works in every other business.
Withdrawing cars or software or nail polish or recommended finance strategies from use takes time, and if you make a critical fuckup then the methods for speeding up the withdrawal time are either non-existant or really piss people off.
It's a quirk of the legal system that you can "patch" these issues instantly, but you still have to unilaterally fuck people (at least in potentia) to do it.
The correct way to do it would be to take responsibility for the quality of your work and guarantee you won't change the agreement on people.
At the very least, you could state any changes will be binding for one week, and anyone who hasn't explicitly opted in to the new version after a week gets cut off until they do, but is released from that version.
[1] See, e.g., the clause and extensive annotations at http://www.commondraft.org/#AmendUnilateralCls (self-cite).
On my side, you want me to agree to do things and on your side "we'll try for 45-90 days." That's not good enough.