We already agreed in T8077 that the bold font should only be used if the secret part of a certificate (secret key) is available.
But for S/MIME Root CAs the default appearance is bold font with a blue-with-a-hint-of-purple background:
The contrast here is only 4.63 and which is even in combination with the bold font not sufficient.
Our contrasts for the light green (VS-NfD compliant) and red (not compliant) have a contrast around 13.
We can't go into plain blue, as the highlighting color is blue. Kind of lavender seems fine to me, like these:
#c2c2ff contrast 9,02:
#dbdbff contrast 11,29:
#ebebff contrast 12,93:
And while we're discussing font styles (this one only relevant for Gpg4win):
Why is the default font color black for revoked certificates but red for expired? I think both should be red.
