It turns out there is an online game which has updated to include a CA root certificate, self-signed, under a domain name the company doesn't actually own. ... I presume this was for internal testing and having the production installer install that certificate (untrusted) on users' systems was probably a mistake, but is this exceptionally bad for users, or are they mostly protected by a system choosing not to trust that cert by default?