That is one bag of trust, yes. "The web CA pool" (there's not just one, there's actually at least four in common use in America (Google/Chrome, Mozilla, Microso

That is one bag of trust, yes. "The web CA pool" (there's not just one, there's actually at least four in common use in America (Google/Chrome, Mozilla, Microsoft, and Apple), with several more besides) But most modern apps don't just connect to the internet, they connect to internal stuff like databases using TLS as well. It's actually a valid strategy to just use the web trust pool for that as well - I personally use it in places, with the certificate managed by CertBot reused for the webserver and the postgres server. It's not a solution for the modern enterprise, where mutual TLS is sometimes a requirement and is attractive if not. You will want to have at least one non-web CA pool (Trust Bundle) for your enterprise, and sometimes several more for other departments, or other companies you collaborate with.