Yeah, if half-smart, certificates should expire relatively frequently to contain damage in such a scenario.