Linux Certificate Authority root stores have a too simple view of 'trust'
There is no API to actually handle trust.
If you are asking `curl` or `openssl` to verify the chain, it needs to read it from somewhere. By convention, there is `OPENSSLDIR`, for example.<p>But that just tells us where the root certs are, not much more.
In the API, I load the root CAs and check validity of the cert, nothing beyond that.<p>And I can do that in multiple different TLS engines.<p>Given that there is no API for this, all the TLS engines need to re-implement this logic.
Hell, in most cases, even things like validity range checks are handled by the applicative logic.<p>On Windows, there is the builtin TLS API `schannel` which means that you have a lot more structure / order in this. Including the ability to express those sort of details.<p>There is another aspect, as well. You need to be able to <i>express</i> those issues as errors, otherwise the user is going to be left with a broken box and no idea what is going on.