Pushing boards to start with metrics first sounds tidy, but it can turn into theater if the metric is just "percent of inventory collected". The hard part is usually the ugly edge cases, old devices, embedded trust stores, and the stuff nobody can rotate without breaking production. I also don't buy dual-stack PKI as the default migration plan. It tends to create a long overlap where everyone assumes the new path is being exercised, while the old path stays quietly trusted because it is easier to keep alive.

Dual-stack PKI always sounds temporary until you realize the long tail is years, not quarters. Who owns the cutoff date when half the fleet never gets there?