Debian Trixie is supposed to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" in ca-certificates 20250419+deb13u1. [1]

I don't see that update available after `sudo apt update && sudo apt upgrade`, and one of the `curl` commands from this thread still succeeds. How long does these typically take from notice to actually being available on whatever mirror one hits?

In the meantime I ran `sudo dpkg-reconfigure ca-certificates` and unchecked those two particular items. That worked.

edit: doh, it was an own goal. I had a `/etc/apt/preferences` that was causing it to prefer `stable` over `stable-security`. facepalm. not sure how I ended up with that, but clearly I did something dumb. should anyone else be wondering, `apt-cache policy ca-certificates` is helpful.

[1] https://lists.debian.org/debian-security-announce/2026/msg00...