I don&#x27;t think that would work very well.  After all, the list of certificates would have to be a preference, so crapware could just stick its own certificate into the preferences file before installing its addon.  Of course, baking the requirement into the binary isn&#x27;t perfect either, since the crapware can just patch or replace it if it has sufficient access rights, but I&#x27;d say it &#x27;feels&#x27; drastic in a way changing preferences doesn&#x27;t (which matters if the crapware is trying to be semi-legitimate), and it requires somewhat more work to come up with a suitable binary and keep it up to date.