Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS endpoints, rejoice: the just landed Apple OS update to 26.7.2 / 27.2 will revert that for you and put the emSign and AAA roots back.

:facepalm: #emudhra