[Brian_K_White]

You should also have the final say in what is NOT trusted. Not merely adding a cert to trust.

[tssva]

You can disable individual system certificates in the "Trusted credentials" settings panel.