A root's own signature proves nothing; trust comes from its inclusion in a store. Root keys are kept offline in HSMs and used only in key ceremonies to sign intermediate certificates, cross-signs and revocation lists. Their validity periods are long, often 20–25 years, but root programs now cap how long a root may stay trusted for TLS: Mozilla removes the websites trust bit and Chrome removes the root once its key material is more than 15 years old, phased in from April 2025.
Rotating a root takes years because every client needs the new one: a new root is usually cross-signed by the old one so that devices without the update can still build a path. Let's Encrypt's ISRG Root X1 (RSA 4096, created in 2015) and ISRG Root X2 (ECDSA P-384, 2020) followed that path, and its newer Root YE and Root YR are cross-signed while awaiting inclusion.
To check which roots a client trusts: Mozilla's certdata.txt (also used by many Linux distributions and the certifi package), the Chrome Root Store list, Apple's trust store pages and Microsoft's Trusted Root Program list.