These are legitimate concerns, but this is like beheading to treat a headache. Technically it works.

I'd suggest to add a notification dialog when a root cert is added, and a good, clear UI to manage the certs: when added, by what app, disable, remove, etc.