Comment by songgao

Yes, this has always been the case. The root CA is embedded in the Keybase client: https://github.com/keybase/client/blob/master/go/libkb/ca.go

This provides a way to add some protection against a polluted trusted CA store.