Fun fact: esp-idf includes an x509 Certificate Bundle API[0] that will pull in the entire Mozilla trust store by default. However, they will be stripped unless firmware calls `esp_crt_bundle_attach`. There is an issue[1] tracking removal of the eMudhra root CA certificate.

[0] https://docs.espressif.com/projects/esp-idf/en/latest/esp32/...

[1] https://github.com/espressif/esp-idf/issues/19282