Do pip / certifi / node bundle their own trusted certificate authorities? Surely you should just be able to remove the compromised intermediate certificates from whatever store you're using and pip / certifi / node refer to the operating system's CA store and prevent that.