Comment by neop1x

Then eMudhra happens and all that security theatre goes down the drain as you (as a device owner) are not allowed to even disable a pre-installed "trusted" CA. And then you can also run a old, vulnerable device with a "signed" OS and SafetyNet will happily allow you to run such apps.