What you are describing is actually your own, reduced auto-update feature, limited to updating what amounts to a "trust store" for certificates.
The bad thing about it is that it works outside of the normal app update mechanism, without much possible user intervention, so the user will get the updates whether he wants them or not.
The good thing about it is that it works outside of the normal app update mechanism, without needing user intervention, so the user will get the updates even if he believed that he could live without them.
Google Chrome has been doing just that for some time, and even update the actual software code, not just the trust stores; and it seems to work well with them. As @mikeazo comments, if your "root private key" (the private key for your self-signed certificate) ever gets stolen, you are in deep trouble, so maybe you should use a signature strategy: instead of making your server be some HTTPS server (with the self-signed certificate for SSL), make it a plain HTTP server, but have the "list of valid certs" be a signed piece of data. That way, you can handle the signature process on a distinct machine, preferably an offline computer (if the private key never leaves a computer which is never linked to any network, then chances are that the private key will not be compromised remotely).