[epse]

Android has always had an "install certificate from SD card" option, so it's absolutely possible, just very annoying

[lxgr]

Starting with (I think) Android 6, this will be accompanied with a non-discardable "Somebody might be tracking you!!!" scare warning in the menu bar. I'm not a fan of the idea of educating users to ignore something like that.