I wonder whether IdenTrust imagined that a five year cross signed root ca would be too little a timespan to get wide adoption.
Btw... Wouldn't it be possible to just add a new root ca to android? Maybe an app could simplify delivery?
I'd be very surprised if an app without root privileges could install a new root certificate. If an app installed a malicious (or even just a poor quality) certificate, that would be a pretty big compromise to the OS.
What is strange to me though, is that it seems like the OS should have a mechanism to update the root certs independently of the OS itself. Then again, not updating root certs is a way to put an expiration date on a phone, forcing customers to buy more phones...
Its not like the OS can actually withstand the app though, looking at a years out-of-date OS with thousands of accumulated known bugs.
Maybe a single confirmation box "would you like to add this ca" would work.