How does one remove a certificate authority's certificate from a system?
Run
sudo dpkg-reconfigure ca-certificates
That should give you a list where you can deselect CAs.
The list of CAs is stored in the file /etc/ca-certificates.conf. If you edit this file manually you need to run
sudo update-ca-certificates
to update the actual certificates in /etc/ssl/certs/ (if you use dpkg-reconfigure that is done automatically).
See /usr/share/doc/ca-certificates/README.Debian for more information.