KMail & Kleopatra & S/MIME

Hello everybody,

I'm trying to understand why Kmail doesn't trust new S/MIME signatures
automatically although they are signed by a well known CA. Am I right in
the assumption that Kleopatra does not access any system wide CA store
and that I have to trust every single Root CA myself? All I could find
was this outdated list of Root CA's from KDE4(?):

https://github.com/KDE/kdelibs4support/tree/master/src/kssl/kssl