Certainly you're aware that every certificate sits in a separate file and an update can just remove the interested files?
not convinced? take a look at your /etc/ssl/cert.pem
Well looks like they should take the hint from a better vendor such as Debian then :)