I'm more concerned about why I can't see a list of sites that CA has authenticated, or put my own restrictions on them. Taking the first one: AC Camerfirma S.

I'm more concerned about why I can't see a list of sites that CA has authenticated, or put my own restrictions on them. Taking the first one: AC Camerfirma S. A. I suspect I've never authenticated anything against that CA. I'd love to know what sites it has authenticated, and maybe I'd be happy with a lot of .es sites Wouldn't surprise me if I rarely if ever encounter 80% of the CAs that I trust. Looking through I'd be happy if some of the signed .ae, or .cn, but not .de. If I did visit an unusual CA, I'd like to make a judgement call on that access. Sure, the big ones (letsencrypt, globalsign, etc) woul dneed to just trust completely, but having a "you are visiting youremail.com, last time you visited this was signed by Globalsign with a certificate expiry of 5 months time, today it's signed by Odd Looking CA, continue? Sure for 90% of users would click though, and it shouldn't be an option for 90% of users, but I'm not 90% of users. Same with importing. If I make my own certificates for my own stuff, I want to import my CA and trust if for .mydevdomain.com, but not for mybank.com, because I don't trust my own security enough to have anyone, including me, have a skeleton key to my entire communication chain for key sites.