This makes me think that the package containing the trusted certificate list ought to be separated into a standalone repository, so that it is easy to change (like how you subscribe to an adblock list).

the implication being that if you don't find it easy enough to do it, then you probably aren't expert enough that you should be doing it.

> it's just deliberately not easy

And thus crippled and useless against state attackers.

I fail to see the reason why my browser refuses to let me "pin" a CA only for certain sites for example.