std.tls Certificate Verification: System Trust Store Integration

Zig's std.tls implementation relies on the mbedTLS backend for handling TLS connections. While the library provides mechanisms for certificate verification, there is a discrepancy in how root certificates are handled across different target operating systems.

Currently, the default trust store may not automatically incorporate platform-specific root certificates, such as those found in the macOS Keychain, Windows Certificate Store, or Linux /etc/ssl/certs. This creates a challenge for applications that must validate certificates issued by private or enterprise CAs without bundling the root certificates directly into the binary.

Given the current design of the CertificateVerifier, it is unclear if the standard library intends to implement an automated system-wide trust store discovery mechanism or if manual configuration will remain the required standard for cross-platform compatibility.

• Does std.tls provide a standardized way to load the host's system trust store across all supported platforms?
• What is the recommended approach for ensuring consistent certificate validation when the target environment uses a private CA?