All or None.
The singly-rooted CA trust paradigm we inherited from the 90s is almost entirely broken.
Vanilla browsers do not track or alert if the Certificate Authority backing a SSL certificate of site has changed, if the old and new CA are both recognised by the browser1. As the average computer trusts over a hundred root certificates from several dozen organisations2 - all of which are treated equal - any single breached, lazy or immoral certificate authority can undermine any browser anywhere.
The problem is compounded by the fact that almost all of the certificate authorities are not democratically accountable to you (i.e. private companies or foreign governments) and have little or no legally-enforced regulation over their day-to-day conduct. Maintainers of CA lists (Microsoft, Apple, Google, Mozilla, Oracle, etc) do not have the resources, legal authority, or inclination to audit the internal conduct of certificate authorities.
The epistemological riddle of who and what are we actually trusting, that was introduced by a 1990s Netscape trust kludge3, will require an expensive overhaul to resolve. Which I don't see happening this side of an threatened or actual cyberwar.
- If your computer (say, a server) doesn't talk out to unknown or ad-hoc sources - then run your HTTPS traffic through a proxy with an explicit list of trusted leaf-node certificates and no root certificates.
- For normal computers which browse the internet and update dozens of applications in the background, just trust all of them and follow other security principles to protect your computer instead.
1. Back-end services and frameworks couldn't usefully prompt on change anyway; as they often lack interaction with the user and need to provide seamless operation.
2. See Firefox or iOS CA lists for example.
3. Try as I might, I couldn't re-locate a fascinating web article about how Netscape developers introduced the current Root CA paradigm as quick patch for theorised Man-in-the-Middle attacks for as-yet hypothetical eCommerce. Digital security is hard; and the cold war hangovers and legislative techno-illiteracy of the early 90s didn't help.