New Certificate Trust Store usage unclear

Can anyone provide more details on exactly how and where the new Certificate Trust Store is used? 

The

suggest the Trust Store is intended to support adding additional root certificates to allow Named Credential callouts to endpoints signed by a private or internal CA not already in the global Salesforce-managed trust store. 

However, the

indicates that the Trust Store is used for "for validating inbound TLS connections" (???), and also states "The Certificate Trust Store supports Named Credentials integrations only." 

The help text within a Winter 27 sandbox states it is used for "API calls and SSO":

1) Where exactly is the new "Certificate Trust Store" used?  Is it Named Credentials only?  Is it with outbound TLS connections or inbound, too? 

2) It is also unclear if the new "Certificate Trust Store"

certificates.  In other words, customers should never need to upload public root ceritifcates that are already present in the global Salesforce-managed trust store, customers only need to upload root certificates from a private or internal CA, right? 

Thanks!