Thanks for the helpful reply!

    > lots of tools ship their own CA bundle.

Can you give an example for Homebrew? And did the package maintainer explain why?

With the exception of Java, on a modern enterprise Linux box, all packages use the same CA cert pack.