Do systemd-resolved DNS-over-TLS sessions use ca-certificates trust anchors after trust store updates?

The integration boundary between systemd‑resolved DNS‑over‑TLS and the Arch Linux ca‑certificates trust store determines whether a trust‑anchor update propagates to active DoT sessions.

Confirm that systemd‑resolved is the active resolver (readlink /etc/resolv.conf, systemctl is‑active) and that resolved.conf shows DNSOverTLS enabled; note that modifications to /etc/ssl/certs/ca‑certificates.crt may remain invisible to ongoing DoT connections until the service is restarted.

Does a trust‑anchor update require a systemd‑resolved restart for DNS‑over‑TLS validation? Will existing DoT sessions continue using cached trust data or revalidate automatically? Is there a documented method to force revalidation without restarting the resolver?