A truststore update keeps the same certificate subject but a new public key, and one mTLS client still pins the old key hash

Everything looks like the same identity, yet a deeper trust assumption at the client breaks connectivity.