Comment by agwa

> This is fine. If you're using a tool that's connecting to the internet, you probably need to monitor for updates anyway.

People should do this, but in practice it often doesn't happen - as witnessed by the Appmattus library fiasco earlier this year.

> I'd like to see a separate package, similar to Mozilla's `ca-certificates`, but for CT that can be updated independently of the actual useragent.

Considering how slowly updates to the various ca-certificates packages propagate, this would be absolute disaster for CT.