In the section about certificate extensions, the ITU-T X.509 recommendation writes:
The private key corresponding to a certified public key is typically used over a different period from the validity of the public key. With digital signature keys, the usage period for the signing private key is typically shorter than that for the verifying public key. The validity period of the certificate indicates a period for which the public key may be used, which is not necessarily the same as the usage period of the private key. In the event of a private key compromise, the period of exposure can be limited if the relying party knows the legitimate use period for the private key. There is therefore a requirement to be able to indicate the usage period of the private key in a public-key certificate.
I don't understand why there is a difference in public vs private key validity period. Why would the private key be used over a different period? When the private key is compromised, there is no point in using the public key anymore. Except to authenticate a message that we know has been issued before the private key's compromission. But then why would the public key lose validity after some time?