Most of the certificates are updated through whichever update mechanism that is available to the system. You cannot be certain that the certs that are installed with the browser are not effectively used for mitm. On the other hand, you could write a small script that uses openssl client mode to retrieve the x509 certs of SSL based targets and from there do a comparison with the incoming site's signature.
This does not scale very well though. Also you might be aware that, at least of macosx, there is the ocsp client that also functions to revoke x509 certs. The problem is such that once you have a rogue root cert installed in your system, just about everything can be spoofed, which includes downloading of any solution over https. At the very worst, you can download, at least for firefox, the set of certs that are installed in the browser and do a quick corroboration test. But over the same broken system? Boot up in a livecd, possibly ubuntu, and do the downloads that way.
Please hug your poor system administrator that has to confirm whether your certs are in order.