- Introduce the ca-legacy utility and a ca-legacy.conf configuration file.
      By default, legacy roots required for OpenSSL/GnuTLS compatibility
      are kept enabled. Using the ca-legacy utility, the legacy roots can be
      disabled. If disabled, the system will use the trust set as provided
      by the upstream Mozilla CA list. (See also: rhbz#1158197)