Applocker Rules and Root Certificate Dependency

Question

Using Applocker rules with Publisher conditions, which are based on digitally signed executable files.

The signatures are timestamped (countersigned) within the code signing certificate's validity period. When implemented correctly, everything functions well. However, a question arises regarding the dependency on root certificates, whether directly or indirectly linked (via intermediate certificates) to the signature.

Does Applocker require a valid trusted root certificate to allow or deny a signed file execution, or does the timestamp ensure the rule's outcome indefinitely? Specifically, does the expiration or revocation of the trusted root certificate impact Applocker, as long as the signature is timestamped as described?

An authoritative answer on this matter would be greatly appreciated.