Our CA reference for the Untrusted section > At present, we retrieve the entire certificate chain and verify whether the signing authority is trustworthy. For this, our main mechanism is to check whether the certification authority is self-signed or not.

Our verification to determine if a certificate is self-signed is based on comparing the AuthorityKeyId and SubjectKeyId fields. If they are identical, or if the Authority Key Identifier is empty, it indicates that the certification authority is not trustworthy, and therefore, the certificate is considered "untrusted."

Ref: https://security.stackexchange.com/questions/93162/how-to-know-if-certificate-is-self-signed/162263#162263