How does Apple decide to include root certificates in "macOS Trust Store"

Thanks Barney-15E

Noted and understand the geographic freedom of Root CAs.

However as you point out it is the secure website certificate that is underpinned by the root CA.

As there does not appear to be a rationale for inclusion in the Apple list assessment of the risk associated with each root CA matches particular needs or appetite for risk. So has the Hong Kong Post office been included because they are a worldwide trusted Root CA or because they are one of the best administered for that geographic region? Who knows.

Thus if anybody wants to apply, admittedly crude, geo ring fencing you might not want to trust any site in that trust chain, without case by case confirmation. The potential effectiveness of this approach will depend upon Apple's rationale for inclusion in the trusted list. Apple to give them credit does publish its own CPS indicating a commendable level of transparency, therefore why not the principles of how the Trusted Root CA list is compiled and how any appropriate categorisation may be applied. (note it may be tricky to detail each specific decision). With all the care and attention Apple takes in the security realm it is inconceivable that such a rationale does not exist, just that it does not appear to be published - unless somebody can share/point to a source. :)