Another comment: Technically merely "emSign_ECC_Root_CA_-_G3.crt" out of the eMudhra roots would need to be removed to mitigate the currently known leaked private keys. However, considering the circumstances around the leak of the private keys are not known, I refuse to trust any eMudhra root at this time.