Linux Certificate Authority root stores have a too simple view of 'trust'
There is no API to actually handle trust.
If you are asking `curl` or `openssl` to verify the chain, it needs to read it from somewhere. By convention, there is `OPENSSLDIR`, for example.But that just tells us where the root certs are, not much more.
In the API, I load the root CAs and check validity of the cert, nothing beyond that.And I can do that in multiple different TLS engines.Given that there is no API for this, all the TLS engines need to re-implement this logic.
Hell, in most cases, even things like validity range checks are handled by the applicative logic.On Windows, there is the builtin TLS API `schannel` which means that you have a lot more structure / order in this. Including the ability to express those sort of details.There is another aspect, as well. You need to be able to express those issues as errors, otherwise the user is going to be left with a broken box and no idea what is going on.