This is what facebook ships with their API php client: https://github.com/facebook/facebook-php-sdk-v4/blob/master/src/Facebook/fb_ca_chain_bundle.crt
It contains dozens (hundreds?) Root CAs.
But doesn't it make the client more prone to MitM attack?
To clarify why I think: it's more chance that some of CA certificates will be compromised, than if they included a single certificate - the exact one they sign their certificates.
Am I missing something?