- Introduce the ca-legacy utility and a ca-legacy.conf configuration file.
      By default, legacy roots required for OpenSSL/GnuTLS compatibility
      are kept enabled. Using the ca-legacy utility, the legacy roots can be
      disabled. If disabled, the system will use the trust set as provided
      by the upstream Mozilla CA list. (See also: rhbz#1158197)
    - Includes the fixes for rhbz#1158343
    - remove the obsolete blacklist.txt file
    - remove the unnecessary entry in trust-fixes, because we no longer ship the old entrust root (it got replaced with one that contains the basic constraints extension)