Stop trusting the compromised eMudhra CA certificates #634

On 2026-10-20 it was disclosed that the private keys of eight eMudhra (emSign) intermediate CA certificates can be recovered from the public certificates (https://emudhra.we-have-a-problem.com). Anyone holding one of the keys can issue a certificate for any domain, and clients that trust "emSign ECC Root CA - G3", or Sectigo's "AAA Certificate Services" through its cross-signatures, will accept it. No exploitation has been reported.

Software in this repository trusts the affected roots. #632 describes where, how that was established, and the changes that remove the trust.

Done when:

• Stop trusting the compromised eMudhra CA certificates #632 is merged.
• The operator actions listed in Stop trusting the compromised eMudhra CA certificates #632 are complete.