My understanding that go at least doesn't ship their own root store; they're shipping a patch to blacklist certain intermediate certificates instead, even if whatever OS-level root store would have accepted them.
Basically, the design didn't have a way to distrust anything other than removal from the root store. Which may still happen, but that will take longer.
Basically, the design didn't have a way to distrust anything other than removal from the root store. Which may still happen, but that will take longer.