[NooneAtAll3]

> default trusted store of root CAs (which lives in the browser or OS, depending).

speaking of that, is there any way to verify that stored certificates are actually valid?