fix(certificates): temporarily distrust emSign ECC Root CA - G3

Eight eMudhra intermediates chaining to this root were generated with
trivially recoverable private keys (Mozilla bug 2083449), so anyone can
mint certificates that non-browser clients using the system bundle will
accept. Browsers already block them; the system bundle does not until
cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable
yet. Drop this once the flake lock includes that commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/nixos/certificates.nix

@@ -17,4 +17,9 @@ in
   security.pki.certificates = [
     caddyRootCA # self-signed pki ca for my home-lab
   ];
+
+  # Temporary: eMudhra intermediates under this root have recoverable private
+  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
+  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
+  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }