Comment by gringofyx

A flat cert.pem file (or similar) can't say "distrust this intermediate".

macOS already has the verifier needed (Security.framework/trustd path that protected Safari). It would be good if MacOS routed CLIs through it.