Hello,
(intentionally quoting out of order)
In the meantime, revoke the certificate:
sudo trust extract --format=pem-bundle \
--filter='pkcs11:object=emSign%20ECC%20Root%20CA%20-%20G3;type=cert' \
/etc/ca-certificates/trust-source/blocklist/emSign_ECC_Root_CA_-_G3.pem &&
sudo update-ca-trust
ca-certificates-mozilla 1.131.1-1 amended that issue already.
With today's certificate leak <https://emudhra.we-have-a-problem.com/>,
it is shown how important it is to implement proper certificate
revocation. I believe that a auto updating system-wide trust store
should be implemented, ideally one that allows for specifying a custom
server that serves from upstream for datacenter wide updating of custom
roots along with public roots.
Contributions to the community, like writing and maintaining a
program to perform this operation, are always welcome.
But partial upgrades are unsupported on Arch Linux⁽¹⁾ and unattended
running of pacman -S/-U is discouraged in support channels. Remember to
warn your users of that.
Also mind that merely updating the CA store is only a partial mend.
System administrators generally must also review which programs depend
on the certificate, as in some cases a restart is needed. The users need
to be aware of this or they may get a false sense of security.
⁽¹⁾
https://wiki.archlinux.org/title/System_maintenance#Partial_upgrades_are_unsupported
