> As far as I can tell it has every national CA except the US. Annoyingly, it doesn't have my country's national CA hierarchy (https://bugzilla.mozilla.org/sho

> As far as I can tell it has every national CA except the US. Annoyingly, it doesn't have my country's national CA hierarchy (https://bugzilla.mozilla.org/show_bug.cgi?id=438825 https://bugzilla.mozilla.org/show_bug.cgi?id=438825). Why is it annoying? Because it means you have to add it manually, and manually added root certificates have more power than the root certificates that come with the browser! In particular, they can bypass HPKP (security.cert_pinning.enforcement_level defaults to 1).