TrustStore.findTrustedRoot

Finds the stored trusted root matching a presented certificate.

A match requires BOTH the subject name and the SubjectPublicKey to be equal. Comparing the distinguished name alone would let an attacker establish trust with a self-signed certificate that merely carries a real root's DN (the classic anchor-spoofing bypass): matching the public key too means only the root authority's own key material can anchor a chain.