With the Linux 6.4 kernel there is the ability being introduced so that the machine keyring can optionally only store CA-enforced keys…

Source: Phoronix – Linux 6.4 Allows For Optional CA Enforcement Of The Machine Keyring