What is Department of Defense Root CA 2 doing on my Mac?
It's one of the trusted certificate authorities for at least OS X Mavericks (10.9) through OS X El Capitan (10.11), so under those OS versions it'll be in the System Roots keychain. It was apparently removed in macOS Sierra (10.12); I don't know why. Apple publishes the lists of trusted CAs; see Support Document HT202858: "Lists of available trusted root certificates in macOS" for links to the full lists.