[peeters]

I would assume their root trust store could be similar to what your browser would use. i.e. a curated set of root CAs with CRL subscription.