Every person running a full node would theoretically be a controller in that case. But as you say, you could probably make a "business requirements" case if it's just a certificate. Right to be forgotten does not include the right to demand people forget that you owe them money, for example.
What gets more complex is if you put non-business-related "sensitive" personal data in an immutable system, e.g. if you're building an illegal blacklist of union organisers.
What gets more complex is if you put non-business-related "sensitive" personal data in an immutable system, e.g. if you're building an illegal blacklist of union organisers.