Let's Encrypt new hierarchy plans

[jtl]

@jsha

We want to get additional cross-signatures on some of our intermediates from IdenTrust’s DST Root X3. This will extend our trust on older devices (including Android pre-7.1). The new cross-signs will expire September 2021.

The elephant in the room. After the DST Root CA X3 expires in September 2021, are there any other root CA's you could get a cross signature from to bridge trust with legacy clients?

Cheers