The eMudhra CA compromise highlighted systemic issues within the Python ecosystem's handling of certificate authorities. CPython relies on OpenSSL, which needs CA root certificates, and Python bundles these via the certifi package for platforms lacking native support. Historically, certifi was crucial, but Linux distributions now provide their own better-managed certificate stores. A significant problem is the lack of a default, active certificate revocation mechanism in OpenSSL-based Python installations. Upgrading certifi as a dependency causes cascading updates across the entire Python and pip ecosystem. Pip bundles certifi, meaning a compromise can necessitate urgent updates to both pip and Python itself. The Python Security Response Team must then coordinate releases across multiple Python branches. Pip is transitioning to use truststore by default, which would reduce its reliance on certifi, especially for Linux users. This incident required many other packaging tools and infrastructure components to act quickly. Alerting users to upgrade dependencies after patches are applied remains a major challenge. The author suggests that PyPI should cease being a certificate distribution channel, given that most platforms now offer adequate CA bundles. A shift towards relying more on system-provided certificate stores is proposed to alleviate the burden on Python and pip maintainers. The open question of effective certificate revocation for OpenSSL-based systems needs addressing to reduce future volunteer strain.