@mjg59 @tris There's no reason /etc/ssl should be updated by a distro update workflow. It's trust policy configuration, not code. You can have a system for the user to keep it updated from whatever upstream they trust, and have that update policy do things like only allow removal of trust not addition of trust except with the user or something major like a distro-upgrade signing off on it.