Debian/Ubuntuのca-certificatesはMozilla準拠だったっけ
https://packages.debian.org/sid/ca-certificates
> Debian can neither confirm nor deny whether the certificate authorities whose certificates are included in this package have in any way been audited for trustworthiness or RFC 3647 compliance. Full responsibility to assess them belongs to the local system administrator.
デスヨネー