Maintaining a certificate bundle is not something to be taken lightly - it's a central root of trust, and is something that should generally be deferred to the

Maintaining a certificate bundle is not something to be taken lightly - it's a central root of trust, and is something that should generally be deferred to the system or user and easily configurable globally. As a system administrator if there is an advisory over a certain set of root certificates, I want to be able to address that and remove that from one or maybe two places on a system. Not wonder about every last package that thought to award itself that authority. Especially the way a lot of python packages are used - as deeply nested and possibly pinned dependencies that maybe never get updated.