dyhkwong：Exclave 的 Mozilla 捆绑 CA 存储不能安全在线更新
dyhkwong 在 Exclave #500 说明，Mozilla CA 存储随 APK 打包且不能自动更新；若用旧存储建立连接来下载新存储，更新过程本身缺少可信的带外信任，因此不能把在线更新当作无风险补救。该说明与当前证书信任方案有关。（AI 推荐）
作者原文@dyhkwongWhy not set "Mozilla" as a default CA certificate provider?
The bundled cert store file can't be auto-updated and can only be updated by releasing a new APK. It is possible to add an in-app updater for the bundled cert store file, but using the old store as the trust to download the new store is already vulnerable. The trust needs to be spread in an out of band way.