Something I've been thinking about for a while is shipping my own minimal version of `ca-certificates` for my own systems.
My theory is that with the number of regional-specific CAs in the default trust store, if I trunk my connection with Zeek for a while and keep only the certs that I actually see used, I could probably remove 50%+ of the list.