eMudhra TLS/SSL CA compromise

[beaker%sdf.org@localhost (beaker)]

I came across the security advisory in the subject line on the
NetBSD blog[1] but the proposed short-term remedy of untrusting
the /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem cert
doesn't work as the forementioned cert appears to be embedded in
the /usr/pkg/share/mozilla-rootcerts/cacerts.pem file and it appears
as if certctl(8) is designed to work with individual pem files.
Is there some way to deal with this issue other than outright
removing the mozilla-rootcerts package?

-B

[1] https://blog.netbsd.org/tnf/entry/emudhra_tls_ssl_ca_compromise