Huh, you're right - it also seems to be enabled by default. I tried with a clean profile and https://revoked.badssl.com/ showed an error (Chrome loads the page).