FWIW, here's what I just did on my (Arch) Linux machine:
$ for f in /etc/ssl/certs/*.pem; do sudo ln -sfn "$f" /etc/ca-certificates/trust-source/blacklist/; done
$ sudo update-ca-trust
This will block all currently installed CAs (as well as double-block some, but that doesn't really matter). You then need to add them back in.Restart your browser, and go to websites you access frequently (change them to https:// if necessary). Click the (broken) padlock and read off what CA they used; remove the corresponding .pem file from the blacklist directory. Some might be signed by intermediate certs and thus hard to find, but SSL Hopper has a great chain inspection tool at https://www.sslshopper.com/ssl-checker.html you can use to identify the topmost CA cert you need to whitelist.
After you're done, run sudo update-ca-trust again, and restart your browser. All normal sites should work, and you've gotten rid of ~160 root certs.