So if you're wondering, #Stripe cares about your #security a lot. That's why they bundle CA certificates in their binding packages and expertly wait a week before updating them. You can't remove compromised certificates just like that, that would be unprofessional. Needless to say, I've unbundled them in #Gentoo now. And I'm ashamed I didn't notice before. I really need to check everything for *.pem, *.crt, and whatever other suffix people come up with. Or perhaps do a more specific grep across all files.