at the time the small print have already been labored out, You'll have to visit the repository of that Root CA and download (and verify the hash) of that certification ahead of downloading it. You should evaluate the https://ca-none.com/