That's the thing about trust -- in order to get into the root key store for windows, chrome, linux, etc they were trusted not to do that.

they violated that trust.