Hello, I have some questions out of curiosity.
In Settings > Security & privacy > More security & privacy > Encryption & credentials, there is this option:
Clear credentials: Remove all certificates
Does it remove or disable any of the system-trusted CAs? I tried looking up clear info about this, but everything I found was either confusing, ancient, or low quality articles. The wording suggests it would, but common sense suggests it wouldn't, but I don't wanna test this on my personal phone. What if I disable one of the system-trusted CAs and then tap this option, would the CA be removed?
There's also this option:
Trusted credentials: Display trusted CA certificates
Inside it, there's a System tab and User tab.
Besides this option, there's this:
User credentials: View and modify stored credentials
I believe the difference between the User tab in the first option and the User credentials option is that the former is for public CA certificates, presented by remote services to authenticate to the user, that the user chooses to trust, whereas the latter is for certificates containing a private key, presented by the user to authenticate to remote services. Is this correct? Does the Clear credentials option clear both of them or only one of them, and which?
Which apps use the OS trust store, and which apps use their own? Do the APIs provided by the OS for third party apps use the OS trust store? Does any GrapheneOS preinstalled app use its own trust store instead of the OS's?
Thank you.