Set the trust order for a newly installed built-ins to 100

security/nss/lib/pk11wrap/pk11slot.c

@@ -1835,6 +1835,9 @@ PK11_InitSlot(SECMODModule *mod,CK_SLOT_ID slotID,PK11SlotInfo *slot)
 	}
     }
     if (pk11_isRootSlot(slot)) {
+	if (!slot->hasRootCerts) {
+	    slot->module->trustOrder = 100;
+	}
 	slot->hasRootCerts= PR_TRUE;
     }
 }