Ed Morley filed this bug http://curl.haxx.se/mail/lib-2014-07/0092.html
Excerpt:
I noticed that mk-ca-bundle.pl fetches certdata.txt from mxr.mozilla.org rather than the actual Mercurial VCS locations.
MXR is just a code indexer for Mozilla's repositories, that
holds cached versions of files from their canonical VCSs. Using
certdata.txt from MXR is not ideal since:
the indexer sometimes fails, resulting in stuck stale files
MXR is due to be retired soon (replaced by DXR)
* MXR is known to have pretty poor security (part of the reason for
retirement), so I would trust the cached copy of files there much
less than from from their canonical location on hg.mozilla.org
Fix pushed as commit 57b53918d1. Case closed!