So if anyone on FreeBSD is wondering how to untrust the leaked CAs now:

1. Go to /usr/share/certs/untrusted
2. Create a new file for each root, with the cert info (Can be found here: https://emudhra.we-have-a-problem.com/roots.json)
3. Run certctl rehash

Same for jails, I copied the files into my Jail base release and ran a quick rehash in all of the.

EDIT: Patch is now available https://www.freebsd.org/security/advisories/FreeBSD-SA-26:73.caroot.asc