Easy: just provide a certificate that cannot be changed within FF (must be modified by changing a file in the installation directory). No preference needed.<p>This would allow developers to roll their own, and organizations to allow their custom policy as well (which could mean that the privileges of the user himself aren&#x27;t sufficient to change the cert).<p>There&#x27;s really <i>no</i> reason as of why this couldn&#x27;t be implemented properly. There&#x27; also no reason to not include a switch for it, really. This is all just smoke: most users have the privileges to change the FF binary, meaning that in most contextes malware has too (either through social manipulation or through exploits).