FWIW, Debian prompts the user in a "medium" priority debconf checkboxes for which of the CAs to enable.
The list is a long one, and provides practically no information about the specific CA besides its name. It can be re-run later using the standard dpkg-reconfigure.
So it's a single dialog rather than dozens of prompts. But somehow I'm not sure the UI is optimal (or even reasonable).