I honestly wonder if there should be some sort of signature or approval process on the OS vendor&#x27;s part before any cert can serve as a root.<p>I&#x27;m not sure what that would look like and I do realize there are some &#x27;walled garden&#x27; implications here. But honestly, I don&#x27;t get how or why a userland application has any right to touch the OS&#x27; trusted CA roots. Perhaps some model similar to driver&#x2F;kext signing would make sense - self signed and&#x2F;or untrusted could be loaded when the system is booted with some development mode flag, but on a general user system, the only path to get your cert trusted as a root COULD be via update&#x2F;push from the OS vendor.