Both chrome and firefox have removed support for this, so we should eventually do the same, maybe only initially for certs that chain back to one of our trusted roots.

See: https://www.chromestatus.com/feature/4981025180483584