Specifically: User-installed TLS certificates are now in a separate keystore from system CAs, users can not disable system CAs, and apps can choose which keystore to trust, but the default is that user CAs are not trusted unless apps explicitly opt-in.

This is extremely user-hostile.