I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA certificate, the only case where I see that would be applicable is if a browser for example doesn't add the new CA certificate in its trust store for a period of time and so it can't verify the new CRLs, is that the case?
Correct. There is no reason to invalidate all issued certificates when a CA decides it needs to re-key - that would simply cause chaos. As such, all those extant certificates need to be managed throughout their life-cycle. In order for clients to continue to carry out revocation checking on any of these certificates the CA must continue to sign a CRL with the original key-pair; as well as a sign a new CRL with the new key-pair.
The CA will now be signing multiple CRLs and clients will need to access the correct version. Therefore the crlDistributionPoint extension on certificates signed by the new key-pair will have a different URL to the certificates signed by the original pair. For example, Microsoft's ADCS appends a
(n) to the filename for each re-key, where
n increases by one each time.