Whoever designed Android to require entire firmware updates to update a root CA is an idiot, and all the people at Google that went along with it.

Any device that is going to last decades, needs the ability to update CAs. Anyone who works with PKI knows this.

So, either they’re incredibly dumb, or they intentionally designed in planned obsolescence. That’s even more damning.