Python's certifi package provides the trusted root CAs for a huge portion of the Python ecosystem. It's also a great example of how complex dependencies can get. Ultimately, these certs are sourced from Mozilla, but they go through 5 hops and a volunteer-run service to get there:

https://gist.github.com/hdm/2e5ebbffa5f29069a42bb69ea9a045ca