Maybe Unix systems should ship an actual certificate validation daemon that speaks the Server-Based Certificate Validation Protocol (SCVP) or similar so that

1. everyone can share one SCT-checker etc,
2. we can centralise fetching updated revocation lists,
3. we can centralise the logic we'll need for merkle tree certifikates,
4. we don't have repeats of mistakes like those times certificates ended up in the CA Certificates bundle because they were in the Mozilla root store to be explicitly revoked

bonus points if for k8s & docker setups you can just bind-mount the socket into the container.