Considering some CA certificates are hardcoded into operating systems, I was wondering what happens when one of these hardcoded certificates is revoked (put on a revocation list for example) because of it being compromised?
Does the operating system have a system for updating it in case it is revoked? How? And how can it be updated after it has expired?