CA distrust is decided by a trust program, but it is enforced one verifier at a time, and each verifier consumes the decision through its own update path. A vendor's action establishes what the vendor changed. It does not establish that each of your clients has consumed that change: CA distrust does not protect a client until that client's actual verification path has consumed the change and rejected the affected chain in a test.

The general point that revocation at a unit is not instantaneous at every verifier is already made in the revocation unit post , which names the trust root as a revocation unit. This post covers the layer beneath it: how CA distrust reaches each client class, who owns each class's update path, and what test shows rejection.…