An enhancement is required to fix bug 1400293. Firefox must be able to distinguish between Mozilla-CA roots and other locally installed roots. The necessary enhancement to p11-kit has been suggested upstream at https://bugs.freedesktop.org/show_bug.cgi?id=99453 This bug requests to pick up this change in Fedora, after the changes have been added to upstream NSS and p11-kit projects.
https://github.com/p11-glue/p11-kit/pull/46
Fixed in p11-kit 0.23.4