Since https://helloworld.letsencrypt.org is still using X1 intermediate it should be easy to add the X1 intermediate signed by ISRG Root X1 to the certificate chain without the need to bring online the root key with a key ceremony.
The root key have to be brought online before May 23 12:00:00 2016 GMT in order to sign the up-to-date CRL (see Signing of the new intermediates). In that date I suppose the root will sign the X3 and X4 intermediates.
The leaf certificate for https://helloworld.letsencrypt.org expire on 29 May 2016 and if it will be renewed 30 days before (i.e. April the 29th, with the X3 intermediate) there will be no test site chaining to ISRG Root X1 between the renewal date and the key ceremony.
In order to always have a test site for the inclusion process I suggest either to delay the automatic renewal of the test site until the key ceremony or to have the key ceremony before the end of April.
1 Like