Apple's git still trusts the compromised eMudhra certificates

As of October 28, git, curl and python3 shipped with macOS reportedly still trust eight eMudhra intermediate CAs whose P-384 private keys can be recovered from their public certificates. Safari and apps on Apple's frameworks are blocked, but tools that read /etc/ssl/cert.pem are not. One independent test on a Mac found Apple's git and curl accepted a forged chain, and Homebrew's git did not help. Builders should remove the roots by hand, recheck after each update, and review macOS CI runners. Apple's response and the macOS 27.2 claim remain unverified.