It is in-scope for a security update, and they say one will be coming. They just couldn’t modify cert.pem without a security update like they did for their own SSL APIs. Hopefully a security update will be coming soon.