change network-security-config at run time

I have the following configuration:

<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system"/>
            <certificates src="user"/>
        </trust-anchors>
    </base-config>
</network-security-config>

I have to trust user certificates because my app can connect to multiple servers and some of them use self signed CAs, don't know which ones prior of releasing the app. Releasing a new update of the app every time a new server comes up, a server changes domain, or the certificate, would be a nightmare.

What I would like to implement is the following: the default would be trust user certificates, after a first connection with the server, if the server sends some kind of flag, like "trustUserCertificate=false", I would like to disable/remove the ability of accepting user certificates.

From what I checked, I didn't find a solution, but also didn't find a place in android's documentation which says that I cannot do it.

Would be something like this possible? If not, is somewhere documented this?