ca-certificates USN-8944-1 Drops One Root, Not Eight Keys.
USN-8944-1 removes emSign ECC Root CA - G3 from ca-certificates. Go 1.27.3 blocks eight intermediate keys. Those are not the same update.
Nginx, Apache, databases, and server software setup guides