If you remove a .pem file from the /var/share/ldomsmanager/trust and /etc/certs/CA directories, you must restart the svc:/system/ca-certificates service and then the ldmd service. Note that any migrations that use that .pem file are still permitted until the services restart.
localhost# svcadm restart svc:/system/ca-certificates localhost# svcadm restart ldmd