Manually editing trusted root CA list in Thunderbird and Firefox

[Christoph A.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

I'd like to remove certain root certificates from my trusted list in
Firefox but any changes I make are not permanent.

Is there a way to have per-user trusted root lists instead of a system
wide list? I suppose manual changes are not effective because the list
is managed via the package ca-certificates.

I'd even like to go so far to have separate root ca lists for Firefox
and Thunderbird because for Thunderbird I only need a handful of CAs.

thanks,
Christoph
-----BEGIN PGP SIGNATURE-----

iEYEAREKAAYFAk50Q6YACgkQrq+riTAIEg3oMACgwFs0Z3Gw05hyrLuetbfCmfMt
vxgAn3K5y4pw1pArDEnpo50SdU/jwGyK
=qthX
-----END PGP SIGNATURE-----