When I download a browser such as Mozilla, it comes bundled with several root Certificates.
How do I trust that these certificates are legitimate? How do I know that my download does not contain some fake root certs?
I know that the software itself will go through an integrity check during the download (which rules out any tampering), however the integrity check itself relies on my existing browser trusting the browser which is being used to download Mozilla over HTTPS. Basically the Mozilla download itself relies on some other root certificate required somewhere during the download process. It seems to be a recursive problem.
So my question is how do I trust the root certificate built into my browser?