How do I import a user CA for the Email app properly?
Ah well. It appears that the Stock Email app doesn't do SNI. This means that in the initial connection to the server it was presented with another certificate it should discard (but didn't). It seems to me that this is a feature request for the Email app, as other apps do implement SNI.

Changing the Apache SSL configuration to use SNI with an initial certificate signed with the "Gert van Dijk CA" still didn't solve it. Logcat then showed:

I/Exchange(12307): IOException while sending request: Cannot verify hostname: mail.mydomain.tld


Setting mail.mydomain.tld as initial certificate solved it. I consider this an ugly work around until this has been fixed in the Email app.