Support generating a Root CA's with a `NotBefore` in the future

Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

I've been trying to write an (OSS) Root CA management tool built upon OpenBao's PKI engine for easy hands off rotation. I have read through https://openbao.org/docs/secrets/pki/rotation-primitives/, though I'm not that keen on cross-signing given it leading to re-signing for a new Root and the remaining alternative would be to have a Root CA do nothing while waiting for the distribution time to lapses.

An idea I've been exposed to before was been generating a Root CA's with a NotBefore set in the future so it can be distributed before use. This would be an additional rotation primitive for OpenBao to provide for Root CAs (IIUC this already exists for intermediates & leaves).

The rotation flow would be (using 90d cycle, rotates at 50% of lifetime, hosts need 30+ days for trust distribution):

• Trust distribution would be a bundle that including 3 generations of Active (GN), Phasing Out (GN-1), Phasing In (GN+1) CAs
• Where Active is actively signing new intermediates/leafs/revocations, this is for 45days & also the max validity of a child certificate
• Where Phasing Out is the previous singing Root, for the the remaining 45 days it is distributed but only is signing CRLs/revocations
• Where Phasing In is distributed for 45 days before its NotBefore - so cannot sign but hosts have ample time to pickup the new CA for it to be used immediately.
• Every 45 days there would be a shuffle of Phasing In -> Active -> Phasing Out -> deleted

The reasons I wanted to use this rotation style is:

1. The new generation of Root CA can be distributed for a longer without sacrificing its validity time
2. Rollback: when transitioning from Gn to Gn+1 you're able to

Describe the solution you'd like A clear and concise description of what you want to happen.

After playing with intermediate & leaf certificates ability to set the NotBefore & NotAfter fields to arbitrary dates (or setting NotBefore + ttl) I noticed that this could also be done for Roots if inputBundle.role.{NotBeforeBound,NotAfterBound} for the Root CA's use of generateCert were controlled.

A solution would be to expose these settings to the user (preferred to not break current user flows), or to default them to permit

Although, I've yet to fully test the implications of running the PKI engine with essentially a invalid Root CA and I suspect there will be edgecases where only NotBefore is not being validated for if its in the future.

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

The alternative approach would be to follow the existing documentation Root CA rotation being:

1. Cross-sign intermediates with the new Root CA - though re-signing, and the part that puts me off is that hosts with older trust stores will fail at expiry of the old Root CA without the ability to rollback
2. Have a "warm-up" phase for a new Root CA for it to be distributed before use - while works it reduces the usable of the signing time of the Root
3. Manual

Explain any additional use-cases If there are any use-cases that would help us understand the use/need/value please share them as they can help us decide on acceptance and prioritization.

Additional context Add any other context or screenshots about the feature request here.