Some of the problems I wasn't even aware of with stuff embedding its own copy of the ca-certificates roots, rather than using the system ones, is mind boggling.

There should be a consensus that, for software you ship, you use what's in /etc/ssl. The same way you read DNS config from /etc/resolv.conf and custom hosts from /etc/hosts rather than embedding your own nameserver and host record config.

Who the operator trusts is *system configuration data* that is variable, not part of your program.