My guess is they have a large-ish set of root certs like every other SSL/TLS library, but one or more may be marked 'magic' in some way. Plus they'll probably want the option to utilize third-party CDNs at some point which often implies a common CA.

Given the rest of what's known about their design I doubt they've deliberated it at a particularly high level in their organization. Or at least, high enough where management doesn't see the benefit of maintaining their own trust root and is glad for the opportunity to outsource something critical.