The change mostly affects captive portals, legacy load-balancers, and cheap IoT admin panels—not public marketing sites on major clouds.
Still, run sslyze or equivalent against every origin hostname monthly; corporate acquisitions leak aged infrastructure constantly.
If you terminate TLS at a regional PoP, confirm certificate transparency monitoring covers all delegated sub-CAs.