ca-certificates in xenial still trusts CNNIC

[Philipp Kern]

CNNIC has been distrusted by Mozilla in April 2015 (https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/). The technical implementation involves blacklisting by notBefore date, which is unfortunately not replicatable by ca-certificates. There should be some kind of action here of pulling the root certificate at some point rather than continue to provide it with blanket trust. (And it's only one example, Startcom and Wosign are more recent ones.)