Comment by solatic

Is there an extension like Noscript, but for CA certificates? In the same way which Noscript blocks JavaScript by default, but allows me to gradually build a whitelist of domains which I agree to run JavaScript from, is there an extension which doesn't trust any of the included CAs by default, and allows me to gradually enable CA certificates over time, so that my trust store is composed mainly of easy-to-trust CAs like Let's Encrypt and doesn't include dodgy CAs operating out of China?