alt Hacker NewsYou can have it "both ways" if you want, but it quickly becomes very muddy - defer to the OS, but override the deferral in some cases.
Certificate management is fifty kinds of all messed up - and in THEORY everything is designed perfectly and properly, in practice it's all bandaids on bandaids that nobody cares about as long as "things mostly work".
This doesn't have the vibes of something that's designed perfectly even in theory. This more has the vibes of "this was the least worst option"