Yes. And not just a security problem but an operational problem, since if you have to rotate a trust anchor you might have a hard time finding and restarting a

Yes. And not just a security problem but an operational problem, since if you have to rotate a trust anchor you might have a hard time finding and restarting all such long-lived processes. IMO SSL_CTX_load_verify_locations() should reload the trust store when it changes, though not more often than once a minute. IMO all TLS libraries should work that way, at least when the trust anchors are stored in external systems that can be re-read (e.g., files, directories, registries, etc.). Apps can do something like that by re-creating an SSL_CTX when the current one is older than some number of minutes.