Do we really need them in the registry at all? It would seem a lot safer to load them directly from some system dir.
I really should think longer before arguing with your feedback ;)
Maybe the Root store should be a read-only one that reads from some system path set in the registry, and doesn't copy the certs in the registry. Does that seem reasonable? Then, as Kuba suggests, the packagers can set it up for people installing that way.
--Juan