Your carrier can preload any CA certificates it wants on the device and install them OTA at least on android devices.

iPhones are a bit more restrictive apps can install their own CA/trusted certificates but these are accessible to the only the apps iirc Apple manages the general trust store on its own with system update.