As of last night the AWS Corretto JDK still ships a trust store that trusts those compromised certs, too.