Also the three of us maintaining requests and the author of urllib3
are all very conscious that the packaged pem file is outdated. We have
an open issue about how to rebuild it accurately while taking into
consideration (and not including) the ones that have been revoked. Any
suggestions you have can be sent to me off list or reported on the
issue tracker.
Is this another issue like the time zone database? Something that
needs to be packaged with some versions of Python, but that needs a
mechanism to update it later for accuracy (which, in this case, also
implies security)?