> Could we propose copying the system keystore and then adding certs to your local copy, rather than recommending that they muck with the system one?

Yeah, you're probably right actually. Having a look at the SRPM for say java-1.6.0-openjdk on Centos, I can see that file is meant to be overwritten if unmodified. The minute anyone touches it, patches no longer get applied automatically. Probably a bad thing to modify in general. I like your compromise though (ie. copy the original + add new ones).

Having said that, if the original certs are copied, we also don't get any new patches from then on :-(. Not that we need those CA certs today (I think?), I'm just trying to avoid the potential ... gawd this is all ugly fugly :-(.