pki: distrust roots cross-signing compromised eMudhra intermediates

Private keys for eight eMudhra intermediate CAs were compromised in
Oct 2026. Blacklist emSign ECC Root CA - G3 and Comodo AAA Services root,
matching the upstream NSS 3.131.1 fix, until nixos-26.05 ships it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

configuration.nix

@@ -68,6 +68,14 @@
     }];
   };
 
+  # eMudhra intermediate CA key compromise (Oct 2026): distrust the two roots
+  # that cross-sign the compromised intermediates, matching the upstream NSS
+  # 3.131.1 fix. Drop this once nixos-26.05 ships cacert >= 3.131.1.
+  security.pki.caCertificateBlacklist = [
+    "emSign ECC Root CA - G3"
+    "Comodo AAA Services root"
+  ];
+
   environment.variables = {
     SBCL_HOME = "/run/current-system/sw/lib/sbcl";
   };