Here is the "magic" that non-security folks never see:
Scroll down to find the issuer: Microsoft Root Certificate Authority 2011 . Verify:
How to Install Microsoft Root Certificate Authority 2011.cer
That said, the 2011cer continues to “work” seamlessly for legacy software compatibility. Microsoft will likely keep it trusted until expiry.
Or via PowerShell:
The introduced: