Rich Felker on Nostr: "Without explicit permission of the user" is meaningless if the application is able ...

"Without explicit permission of the user" is meaningless if the application is able to ask for permission. The only acceptable compromise position is user having to manually dig deep into settings menu to find where to add CA certs, then getting a detailed warning that if anyone has told them to do this, that person is trying to backdoor their device, and that they should only add CA certs for a CA they personally operate or trust.