It occurs to me, I'd be interested in my browser tracking the root certificates it uses and has encountered, and present me with a report of them. I've been int

It occurs to me, I'd be interested in my browser tracking the root certificates it uses and has encountered, and present me with a report of them. I've been interested in curating my cert list personally before, but without an idea of what certs I am in practice trusting (and not just in theory), it's really difficult to know where to start. You're presented with a list of a couple hundred or so root authorities with little more than their name to go by. I could get a real jumpstart if there was 80-90% that I simply never encounter and could easily see that. One way browsers could push back at least a little on this would be to make cert auditing like this easier, and, if not already possible, potentially expose it to extensions. Preferably with a brand new "manage certificates" extension, which the browsers are welcome to and/or invited to festoon with whatever dire warnings about security they like. (It's hard, if not impossible, to create an interface to improve security like this that can't also be used to tear it down.) Giving enough visibility into the cert process that an extension could flag "hey, this is a new root cert you've never seen before" would be nice too. Obviously, my metaphorical grandmother isn't going to be interested in this, but it could at least start a more community-oriented "conversation", in the form of running code, around what cert authorities I trust, rather than the browser coders. I'm not looking to see if this already exists, because if it does I'm sure someone will know exactly where it is and what it's called and can link it to me, and everyone else reading. Please do, if it already exists.