If you use the View Certificate link (sometimes, this requires clicking the Advanced button), is there any pattern to the issuer, such as a proxy server or security software vendor?

They all seem to be issued by dedicated certificate companies, though almost all use Sectigo certificates (the .edu ones use InCommon).

Usually the View Certificate page has multiple tabs. You could start with the right-most tab and see whether that ultimate signing certificate is listed as trusted here as a Builtin Object Token:

Settings page > type cert in the tiny search box to filter the page > View Certificates button > Authorities tab

Or if Firefox is set to use the system certificate store (checkbox for "Allow Firefox to automatically trust third-party root certificates you install") perhaps you need to check somewhere else on the system (I'm not familiar with how Linux handles it).