The issue here seems to be that Mozilla/Google/Microsoft are the ultimate trust authorities for TLS but that is not reflected in how things are structured. If M

The issue here seems to be that Mozilla/Google/Microsoft are the ultimate trust authorities for TLS but that is not reflected in how things are structured. If Mozilla/Google/Microsoft certified the current root trust authorities then an OS could just download the whole mess from Mozilla/Google/Microsoft and could check the validity of them on their own taking into account any revocations.