Stupid question. Who should have the ability to install root CA certs? I like using HTTPS instead of HTTP, so I need some installed. Who should be responsible

Stupid question. Who should have the ability to install root CA certs? I like using HTTPS instead of HTTP, so I need some installed. Who should be responsible for managing them? And before you say the CABF, they're ultimatately not the ones who decide what gets installed on your computer. The answer to that question is much more complicated.