We do warn about the certificate situation in the 8.3 release notes, indeed, but it's easy to get caught by that.
There's a way to temporarily disable LTS verification on the new hosts in order to join it to the existing pool.
See https://docs.xcp-ng.org/releases/release-8-3/#certificate-verification-xs which in turns points to https://docs.xenserver.com/en-us/xenserver/8/hosts-pools/certificate-verification where you'll find that command.
Regarding your initial situation, I'm not 100% sure, but I think Warm Migration, might be a way to migrate your VMs off your slave hosts while minimizing downtime. I don't know how it plays with CBT and heterogenous pool state exactly though.