Hi @rpyne,
The subject of the certificate shared in the report is from the Identrust DST Root CA X3. Root certificates are exempt from the SHA1 sunsetting because, in effect, their signatures are not used in the process of making a trust decision:
In short, the signature on a root certificate is not verified as the software trusts the root certificate public key directly. A root certificate is self-signed and is not signed by another entity that has been given authority. The root certificate gets authority through the root certificate program managed by the operating system or browser developer
You should verify that your hosted customer is not including the DST Root CA X3 certificate in the chain of certificates returned from their webserver in the TLS handshake. Sometimes folks will misconfigure their servers to send the end entity (leaf) certificate, the Let's Encrypt intermediate, and the Identrust Root Certificate. This is incorrect - only the end entity and intermediate certificate should be presented by the web server, the root is expected to be on the client machine.
In short: there's no plan to update the Identrust root certificate - we don't control it directly and its usage of SHA1 isn't an issue.
Hope that helps! Take care,