Are the 'Not trusted after' fields in mozilla respected ?

[zarniwhoop73]

I assumed we were good, but TrustCor certs exist.

[djlucas]

They were included in the distribution, so they will be true for Mozilla trusted, but the NSS-{Email,Server}-Distrust-After field should take precedence in P11-kit, so while an anchor would exist in this case, if they have been distrusted, they would not show up in the bundles. That said, all three of these certificates are still in the bundles because they are still valid in the certdata.txt file. Both NSS trusts are unset: CKA_NSS_{EMAIL,SERVER}_DISTRUST_AFTER CK_BBOOL CK_FALSE - now, that said, certdata.txt in the release branch won't update until NSS updates, and TrustCor has been removed in at least Aurora.