"Requests uses certificates from the package certifi. This allows for users to update their trusted certificates without changing the version of Requests. Befo

"Requests uses certificates from the package certifi. This allows for users to update their trusted certificates without changing the version of Requests. Before version 2.16, Requests bundled a set of root CAs that it trusted, sourced from the Mozilla trust store. The certificates were only updated once for each Requests version. When certifi was not installed, this led to extremely out-of-date certificate bundles when using significantly older versions of Requests. For the sake of security we recommend upgrading certifi frequently!" It isn't completely clear but it sounds like they (used to) copy the Mozilla Trust Store wholesale, which isn't a particularly controversial policy. They might be one of the more open stores.