RFC: root cert tool

[Juan Lang]

> Do we really need them in the registry at all?  It would seem a lot
> safer to load them directly from some system dir.

The trouble is not knowing which is the correct system dir / file.  It
changes from distro to distro, from version to version.  Guessing
seems less safe (to me) than getting them from some known-good source,
or from allowing the user to specify the correct source.

--Juan