Couldn't I just do an Over-The-Update of which root certificates the system accepts since they're already connected to the internet. Then I can add my own non-

Couldn't I just do an Over-The-Update of which root certificates the system accepts since they're already connected to the internet. Then I can add my own non-cloudflare certificate to the list and then move off cloudflare and remove their cert. That should work pretty well right there.