Can't remove a certificate from the revocation lists until it's expired, leading to boundless growth of those lists.

Risk of private keys/certificates from old backup media being leaked (remembering the adobe password leak...) and then suddenly coming back online and working until someone figures out how to revoke them