I can't really tell the difference between trusted-root-certificates and trusted-root-ca. There are some minor technical differences, like in PKIX, a CA requires
basicConstraints=critical,CA:TRUE. But I'm not sure the technical minutiae warrants a separate tag.
Perhaps these should be merged into the most obvious one, and then make the unneeded one a synonym for the one that is selected. I would suggest using trusted-root-certificates, and making trusted-root-ca a synonym.