fix(certificates): drop temporary emSign ECC Root CA - G3 distrust

cacert 3.131.1 no longer ships this root at all, so the blacklist
entry added in #111 is redundant.

Closes #110

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/nixos/certificates.nix

@@ -17,9 +17,4 @@ in
   security.pki.certificates = [
     caddyRootCA # self-signed pki ca for my home-lab
   ];
-
-  # Temporary: eMudhra intermediates under this root have recoverable private
-  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
-  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
-  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }