Tell HN: macOS still trusts the compromised eMudhra

Some rant. Apple blocked the eMudhra intermediates for Safari and apps that use Security.framework. But built-in curl, git and python3 still read /etc/ssl/cert.pem, which still has both roots. No macOS update or advisory yet in a few days.

I reported it to Apple, but has anyone heard anything from them?