TLS certificate management on Android

I see a persistent problem is that it is up to the application developers to decide security policy. "Should all certs be checked against root CA. Should some be exempt?" These are the province of the system administrator, not the developer. OpenSSL, or what ever system is used, needs to serve the purposes of the system first and the application last. It seems to me that the API needs to be changed to force the applications to go through the system and get permission according to established policy and not to decide action on its own.

I think that distros can help by either not allowing non-compliant security libraries to be installed or to provide versions of the common libraries (OpenSSL, NSS, ssh...) that work with the system and not independently.