There's even an SSL extension for the client to mention its list of trusted root CAs in its side of the handshake. It's very rarely used on desktop / on the public Internet because people tend to trust more CAs than would fit in a TCP packet, but it's apparently useful enough in embedded scenarios to standardize.

https://tools.ietf.org/html/rfc6066#section-6

You could imagine a variant for, say, pointing out that you explicitly distrust certain CAs that the server is likely to assume you trust.

Unfortunately, that's not valid per the RFCs (from rfc 5246, TLS 1.2):

"certificate_list

      This is a sequence (chain) of certificates.  The sender's
      certificate MUST come first in the list.  Each following
      certificate MUST directly certify the one preceding it.  Because
      certificate validation requires that root keys be distributed
      independently, the self-signed certificate that specifies the root
      certificate authority MAY be omitted from the chain, under the
      assumption that the remote end must already possess it in order to
      validate it in any case."

I would be super happy if I could send multiple certificates though (provided all my clients magically got tls client library updates to handle it)

Just edited my comment.