So how's about the browsers/root-programme operators simply stop bundling a root store? Instead, they could hive-off their root programme into an independent o

So how's about the browsers/root-programme operators simply stop bundling a root store? Instead, they could hive-off their root programme into an independent operation. Make it possible for the user to choose which root store they want. Does EIDAS mandate that browsers must provide a root store? I occasionally pick over my root store(s) looking for government-run root-certs for governments I don't need to trust. But the names of those root certs aren't transparent; you have to research each one before you can safely distrust it. Most government-run roots are only needed by citizens of that country; e.g. countries that issue government electronic ID that you need for things like voting (which isn't that common). So I'd choose a minimal root store, and then perhaps add back groups of certs, based on what my specific needs were. This could be managed through a slick UI. It would be extra cool if browser manufacturers could restrict government-issued CAs to attesting subdomains of their CC-TLD. It's nuts that (e.g.) the Turkish and Hungarian governments can attest any domain they want.