A program A downloads signed executables and other signed configuration files. Configuration files have a signature appended at the end. To verify their integrity and creator, it uses the public key hardcoded in the program A.
In a couple of years, the certificate that was used to sign the files expires and a new one will be issued. Program A will download the newly updated files, but because it is using the old certificate's public key for validation, it thinks that the files were tampered with.
What is the "right" way for remotely installed programs to identify if an update is safe to apply? Hardcoding the public key is likely to be problematic.