Eight revoked intermediates, weak P-384 keys, and a practical checklist for servers, Go apps and trust stores