I'm not a security expert by any means, but why is telling ELB "dont trust cert X" any better than removing the compromised instances from the ELB via the API (or just terminating the instance entirely)?
because in theory, the private key that was stored on that trusted instance could have been stolen ready to be used to impersonate that machine later on.