Old root certificates or intermediate certificates whose private keys have been recovered, if not thoroughly revoked, may still pose a threat to legacy devices that have not updated their trust chains.