What happens when a distribution certificate expires or revoked?
To answer your questions:


Yes
Yes
Yes


&nbsp;

When revoking a distribution certificate the below scenarios will occur for your users:


When you revoke a certificate that means that any app that is not deployed onto a device (not hosted by AppStore) will no longer be valid. Existing users can continue to use the app. 
When you revoke a certificate and your App is being hosted on the AppStore; users that have already installed the app will not be affected. New users that go to install the app will not be affected. 
When you revoke a certificate and your App is being hosted in-house (internally) and users download it via OTA; users that have already installed the app will not be affected. New users that go to install the app will not be able to install it. Please note this is based off of behavior we have experienced from Apple. 
Revoking a certificate will not affect the ability to update existing apps regardless of whether they are AppStore or in-house apps.


Please note that this has been the behavior observed from working with Apple recently and if any updates were made on Apple's end than this is subject to change.