Using CA pools to safely rotate your CAs