GN: Reset default for fallback root certs to false.

runtime/bin/BUILD.gn

Index: runtime/bin/BUILD.gn
diff --git a/runtime/bin/BUILD.gn b/runtime/bin/BUILD.gn
index 0e75ba274aacd5a48092d2a03589faefe1628bbd..903cc408dc7bc17b18f177f19d6024c54b7eab29 100644
--- a/runtime/bin/BUILD.gn
+++ b/runtime/bin/BUILD.gn
@@ -7,7 +7,7 @@ import("gypi_contents.gni")
 declare_args() {
   # Whether to fall back to built-in root certificates when they cannot be
   # verified at the operating system level.
-  dart_use_fallback_root_certificates = true
+  dart_use_fallback_root_certificates = false
 
   # The BUILD.gn file that we pull from chromium as part of zlib has a
   # dependence on //base, which we don't pull in. In a standalone build of the
@@ -20,6 +20,11 @@ declare_args() {
   dart_use_tcmalloc = false
 }
 
+# TODO(zra): Remove this when Fuchsia has a root cert cache on the filesystem.
+if (defined(is_fuchsia) && is_fuchsia) {
+  dart_use_fallback_root_certificates = true
+}
+
 # Generate a resources.cc file for the service isolate without Observatory.
 action("gen_resources_cc") {
   visibility = [ ":*" ]  # Only targets in this file can see this.