Care to elaborate? I don't see how publishing a list of fingerprints of trusted certs would facilitate an attack. Especially given that the underlying certifica

Care to elaborate? I don't see how publishing a list of fingerprints of trusted certs would facilitate an attack. Especially given that the underlying certificates are public knowledge, sent as part of every HTTPS session.