> ...where Ubuntu just unilaterally reverted Mozilla’s removal of a cert in their package, because it was breaking nuget

It wasn't unilateral. Ubuntu followed Debian here, who did the same revert: https://tracker.debian.org/media/packages/c/ca-certificates/...