As @rdlowrey has indicated, the only certs we check are those at a system level or those bundled by composer, or something the user passes. If any such certificate has been compromised, it's already game over. I don't wish to debate the obviousness of a vulnerability, but we will need an alternative as a best attempt to tell users what's wrong instead of leaving them with some ambiguous security warning that may or may not apply to them in reality.