ca-certificates USN-8944-1 Drops One Root, Not Eight Keys. USN-8944-1 removes emSign ECC Root CA - G3 from ca-certificates. Go 1.27.3 blocks eight intermediate keys. Those are not the same update. server-config