https://github.com/google/santa https://github.com/google/santa seems like it takes this approach. Gives an enterprise the ability to decide which signed certs

https://github.com/google/santa https://github.com/google/santa seems like it takes this approach. Gives an enterprise the ability to decide which signed certs it wants to trust and then block everything else unless it gets vetted.