@Hieronymus's banner p

Also, I think Firefox on most platforms (Windows, most notably) trusts the OS's CA list ...

As I understand the documentation, it trusts root certs that have been added to the OS by an administrator or user but not those included by Microsoft or Apple.