Comment by mschuster91

> This is an additional, ad-hoc blocklist for compromised intermediaries, it's not even roots.

Nonetheless, there shouldn't be a mechanism to override or modify the OS trust list embedded in the runtime. If the application code itself wants to do that (e.g. cert pinning), fine. But as an ops person, I repeat myself, it's an utter headache to deal with SSL trust roots already, and really I don't want to have to learn about N different ways that applications manage this crap.