You can add the intermediate CA to your block list, presumably the distros will do this

Looks like archlinux already did. After update my fake st*pe.com cert no longer verifies. Ufff.

	▲	Scott_Helme_ 3 hours ago \| parent [-]
		The problem now becomes all of the things that can't be so easily updated.