As I understand it these are basically an insurance policy. The promoter takes out a policy detailing the odds of a payout being required, and pay a premium based on the insurer's risk assessment.
And of course the insurer wants to minimise the odds of paying out, and the promoter wants to minimise their premium - so the top prize is usually, as above, near-unwinnable.
Yup, this is on form for them. This isn't the first product they've done it to and surely won't be the last.
The moment the news broke we started migration planning, a short while later their new pricing came through and immediately justified the project spend. Tens of thousands of VMs migrated, a ton of labour, and even some hardware refreshes thrown in - and still cheaper than renewing, by a looong shot.
If you mean signed by your CA then this is me too, albeit with an intermediate CA in the middle (honestly pointless in my case, but old habits etc).
I don't host anything externally and trusting the CA certs internally is easy as Ionly need to do it on a handful of devices. This + reverse proxy keeps things tidy and uncomplicated.
It's just virtualised Deliverance