Since the issue was actually applications that were using pre-2005 versions of OpenSSL that didn't support SHA-2, the "grace period" here was effectively 10 years.