Eight eMudhra intermediates chaining to this root were generated with
trivially recoverable private keys (Mozilla bug 2083449), so anyone can
mint certificates that non-browser clients using the system bundle will
accept. Browsers already block them; the system bundle does not until
cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable
yet. Drop this once the flake lock includes that commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aaronandClaude Opus 5.5
5b38fc4155