I suspect new hardware will need to have only the new certificate if they want some sort of compatibility certification.

That's what I suspect as well. But would this have any actual security benefit or is it just a way to force people to abandon their old hardware like speculated in https://news.ycombinator.com/item?id=44748323 ?