On a fresh install of Leopard when I look at the root certificates this is what I see when I order them by expiration date.
I find the names, dates, and number of certificates suspicious. Is this all normal?
Yes the installed certificates are valid, however I would advise updating to the latest version of Leopard and make sure that the compromised Diginotar certificates are uninstalled: This link at ps Enable provides an easy method for this.
On Root Certificates, they are by their nature long lived since they are the "Master" certificates and having them expire too often would cause issues with SSL certificate chain's world-wide.
This is normal. Don't worry about this.
Mac always send/get a messages from his own server, and this certificates needed for them. And you can see him working how: new updates, new services, ...
Yes, they're listed in date order and all look to be valid root certification authorities.
It is extremely unlikely that anything could be compromised at install unless perhaps you used media downloaded from a third party. If it was real media and the disk was formatted you're almost certainly fine; the only attack vectors then being other infected macs on the local network or infected updates downloaded from fake update servers you're directed to by dodgy dns servers that have been intentionally configured on your dhcp server for that purpose (this scenario is so unlikely you'd stand a better chance of infecting your macbook with a virus by sneezing on it).