This is where I disagree. Most people out there expect system roots to be trusted for them, and honestly most people out there do not have a good understanding of tls or know how to troubleshoot cert installs.