[0x0]

Debian had some fairly dubious CAs included for almost 10 years, so they're not without fault. Looks like they've cleaned up - and at least their processes are fairly transparent.

https://lwn.net/Articles/590879/