Indeed, the problem is that lists of trust anchors are in many more places than they should be. Basically:
certctl for NetBSD 10 and newer mozilla-rootcerts-openssl for NetBSD 9 and older, and probably some others many other systems have their own scheme and then nss, gnutls, and similar all do something that needs understanding and checking some packages have their own mozilla-rootcerts for some packages that use that instead of system rust crates and similar for programs that vendor in libraries so it's harder than you would have guessed last week.
