@CyReVolt For container images it could make sense for docker/podman/kubernetes to come up with something that mounts the CA bundle of the host into the container.

It would help with eMudhra, but it would also help with people having their own internal CAs. There's currently workarounds like https://github.com/chainguard-dev/incert

@CyReVolt I think you're putting words in my mouth which I haven't said. A "single global, content-addressable (cert) store for the entire universe" was not suggested to that extent.

The majority of those programs have already agreed on using a single store anyway. It's Mozilla's CA store all over the place. Except through many independently maintained copies – a python module, a rust crate pinned to old version, etc. – all of which become additional bottlenecks.