Because nobody is going to be arsed to figure this shit out, even the PGP fanatics don't bother.

So someone has to do it, and a pop-up on first boot asking you which "certificate providers" you want to trust would be as pointless as the "which browser do you want to use" ones were.