[rentnorove]

Wouldn't you want to validate it for the time at which it was served? In which case you'd just an archive of the CA roots at the time.

[paxys]

And how do you verify that the CA roots are authentic?

[notriddle]

The Hg history from Mozilla-Central?

[paxys]

Sure but that's still a third party dependency. And then you have to verify that the Firefox source is authentic. My point is there's no way to have a fully self verifying archive.