I mean, they're the TLS certs are baked into the stdlib 'tls' package, not the compiler itself.

It's just an unfortunate unforced error that the go TLS package is bundled along with the compiler, in the same way Safari being bundled with iOS updates is an unforced error meaning a safari security bug requires a full OS update.

There are no certs baked into Go’s stdlib. This is about pkg x509 blacklisting certain certs that get loaded from elsewhere.