macOS /etc/ssl/cert.pem still trusts the eMudhra roots: curl and python3 accept the compromised intermediates

Apple blocked the eight compromised eMudhra intermediate CAs (CVE-2026-111943) for Security.framework clients. But on macOS 27.0.1 (26A434), /usr/bin/curl and /usr/bin/python3 still accept certificates from them.

These tools verify against /etc/ssl/cert.pem and do not check revocation. The file (dated Sep 24) still contains both roots that the compromised intermediates chain to:

• emSign ECC Root CA - G3
• AAA Certificate Services

To reproduce, with SSL_CERT_FILE and CURL_CA_BUNDLE not set:

/usr/bin/curl -sS -o /dev/null -w '%{exitcode}\n' https://dv-g3b-emudhra.we-have-a-problem.com/
# 0 — the connection succeeds

grep -E 'emSign ECC Root CA - G3|AAA Certificate Services' /etc/ssl/cert.pem
# both roots are present

With a CA bundle that does not have these roots (Homebrew ca-certificates), the same command fails with "unable to get local issuer certificate". So the system bundle is the cause. softwareupdate -l shows no update.

Questions:

1. Does Apple plan to update /etc/ssl/cert.pem for this, and will the security notes say so?
2. Until then, is setting SSL_CERT_FILE to a separate bundle the recommended workaround for the system tools?