It appears to me they do, and that is why everybody is saying to patch your python, go, and node infrastructure separately from /etc/ssl.
> which on all platforms has already had this certificate revoked from it.
I know of two systems which this doesn't seem to be the case as of yesterday.
1. I manually edited cert.pm on OpenBSD. I don't see the OpenBSD errata yet.
2. As of yesterday Mac safari was still vulnerable when I tried.
No it is not. As I said, the revoked key IDs is a supplementary list. It is not a root store. They do not add new root keys or transmit any public key material via this path. It may not contain data that is applicable to the root store being used, but it is perfectly permissible to relay a revocation 'out of band' as long as it represents a truly revoked certificate (CRLs and OCSP are out of band in the same sense)
Only in Java is the practice you're describing (full root store bundled with the runtime) widespread. (Edit: Node.js too, apparently)
Is certifi used widely in the Python ecosystem?