Stop trusting the compromised eMudhra CA certificates #698

On 2026-10-20 it was disclosed that the private keys of eight eMudhra (emSign) intermediate CA certificates can be recovered from the public certificates (https://emudhra.we-have-a-problem.com). Anyone holding one of the keys can issue a certificate for any domain, and clients that trust "emSign ECC Root CA - G3", or Sectigo's "AAA Certificate Services" through its cross-signatures, will accept it. No exploitation has been reported.

This repository trusts the affected roots in these places:

• certifi 2025.8.3 in uv.lock, which requests and httpx use. certify-uk-release.yaml installs it with uv sync --frozen in jobs that send HUGGING_FACE_TOKEN to Hugging Face.
• hf-xet 1.1.9 in uv.lock, which compiles in its own CA list containing "emSign ECC Root CA - G3".
• uv 0.12.14, pinned in every workflow, which uses its own compiled-in CA list.

Done when:

• Stop trusting the compromised eMudhra CA certificates #697 is merged.
• The patch release that the merge publishes is out.