I don’t know about windows or Linux, but you can already do this on Mac. Keychain access let’s you change trust settings of each root, including individual “purpose” granularity (eg restrict to just mail servers, etc)