After the changes introduced in JDK-8338383 to X509TrustManagerImpl, the Java runtime forces the loading of the default CA certificates, even if the intention is to load a custom keystore.

The sample code below demonstrates this behavior
// Load the custom truststore
FileInputStream fis = new FileInputStream("CustomKeyStore");
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(fis, "testpass".toCharArray());

// Initialize the TrustManagerFactory with the custom keystore
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ks);