[ghost]

#10227

[Hainish]

@cschanaj we need to make a policy decision for CAcert sites. These should be default_off, since we don't want these sites to be inaccessible by browsers in default configuration. We also want them to pass the fetch test, so that they aren't disabled on the next run of https://github.com/EFForg/https-everywhere-full-fetch-test. Adding default_off="cacert" seems the easiest way to do this. Keeping cacert as the value of the platform attribute makes sense to me as well, since the platform attribute is often used as a selector for specific system configurations to turn rulesets on.

See: #10227 (comment)