Same here, I've always just unscoped them and rescoped them. This has proven to be dangerous in the case of wireless config profiles. There have been two incidents where I clicked "redistribute to all" instead of "redistribute to only newly assigned users", and suddenly I have 150 MacBooks drop off the network. Granted, I can throw up a new open SSID so they have a connection to connect to Jamf, but that makes for a very not fun day.
If the Certs are being removed you could possibly create a smart group that they fall in and it can all be done automatically. You may have to create your own Extention Attribute for this to work.
Try creating a smart group which recognises machines that dont have these certs or have had the Keychain reset then they drop into that group and have the profile is re applied.