Chromium is still polluting stuff with $HOME/.pki because it's not using libnss correctly and developers don't care to fix it, despite a longstanding open bug report.

Which results in everything that embeds Chromium (like QtWebEngine and etc.) polluting $HOME as well.