BSD folks: Is there a native #FreeBSD, #OpenBSD, or #NetBSD tool for managing system-wide trust-anchors? Debian has something like

$ sudo dpkg-reconfigure ca-certificates

which gives an interactive TUI allowing me to specify which CAs I do/don't trust, and they get picked up system-wide.

Ideally this would persist past most package/system upgrades too so I don't have to (re)do it every time ca-certificates gets updated from repos.