I came across the security advisory in the subject line on the NetBSD blog[1] but the proposed short-term remedy of untrusting the /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem cert doesn't work as the forementioned cert appears to be embedded in the /usr/pkg/share/mozilla-rootcerts/cacerts.pem file and it appears as if certctl(8) is designed to work with individual pem files. Is there some way to deal with this issue other than outright removing the mozilla-rootcerts package?
-B [1] https://blog.netbsd.org/tnf/entry/emudhra_tls_ssl_ca_compromise
