I heard back from some of the guys at FNAL, and they pointed out the
FNAL CA cert is part of the IGTF distro:
http://www.igtf.net
and 3 tarball of certs at:
https://dist.eugridpma.info/distribution/igtf/current/accredited/
That covers most of the major scientific/research CA's I know of.
Adding those to Bro would complement the list of commercial CA's
extracted from Mozilla.
Mat