There are legitimate reasons to extend the trusted root certificates (notably: corporate deployments). Admitted, I cannot come up with a reason that has anythin

There are legitimate reasons to extend the trusted root certificates (notably: corporate deployments). Admitted, I cannot come up with a reason that has anything to do with Pokemon, but - in general I think this should be possible. Plus: Who do you want to protect and from whom? The only person able to make Pokemon Go (locally, on their phone) accept another certificate is by having full access to the phone in the first place. It's the user, 'hacking' his own device. If this leads to exploits on the Pokemon Go server for some reason, than _those_ are the problems. The communication between app and Pokemon Go server uses TLS, even if I spoof a certificate for my very own device. For me this is one of the examples of Raymond Chen's "If you're already on the other side of the hatch it isn't a security exploit", but I might absolutely fail to understand the risks of course.