I heard back from some of the guys at FNAL, and they pointed out the
FNAL CA cert is part of the IGTF distro:
and 3 tarball of certs at:
That covers most of the major scientific/research CA's I know of.
Adding those to Bro would complement the list of commercial CA's
extracted from Mozilla.