mozilla-rootcerts woes

[Greg Troxel <gdt%lexort.com@localhost>]

From a public discussion on current-users@, I now believe that
mozilla-rootcerts and mozilla-rootcerts-openssl are:

  installing both email and server certs (which I think is probably ok
  and we should fix DESCR)

  installing certs from CAs that are listed in mozilla-rootcerts but are
  marked as not trusted (e.g TrustCor).

and I'm unclear on others.

Would somebody who is an expert.rootset.mozilla like to dig in and
assess/fix?

Can anyone shed light on how mozilla's concept of server/email maps to
concepts in pkix and API calls in openssl?