Documenting certificate distribution pain points for the Python ecosystem

I'm writing this blog post on the same day as the eMudhra Intermediate CA compromises news was published so the memory of what was required from me and unfortunately volunteer maintainers today is still fresh and top-of-mind. Fixing the systemic issues that many open source projects faced today takes longer than a day of hurriedly patching everything and publishing advisories, so I'm leaving these as notes for future us. I'm only writing from the perspective of the Python ecosystem, although I know at least some of these issues exist elsewhere. Here's some context: CPython uses OpenSSL for TLS on all platforms and OpenSSL requires CA root certificates provided as files, directories, or in-memory data. CPython distributes OpenSSL to Windows and macOS, because those platforms don't distribute OpenSSL on their own typically. Linux distributions do distribute OpenSSL typically. certifi is the Python ecosystems' packaged distribution of CA root certificates. certifi was designed to work…