> This policy would prevent all of those things. That doesn't mean we still won't see CNNIC and Blue Coat/Symantec and other untrustworthy certificates loaded u

> This policy would prevent all of those things. That doesn't mean we still won't see CNNIC and Blue Coat/Symantec and other untrustworthy certificates loaded up by default in all Android devices (which you can still disable yourself), but I think overall this is still a good move from Google. I'm ok with this. Even if I can't add a custom root certificate, I would like the ability to distrust any root certificate I explicitly do not like. That coupled with standardization of certificates loaded by default makes this sound like a welcome change.