You mean nasty root certificates like VeriSign and GoDaddy, which the NSA frequently uses for MitM?

You should do the same to those certificates that you did to TURKTRUST, just throw the US CAs out.