I like the thinking and direction here.

At least, we could use this in situations where root cert is not part of CA stores in os/browsers.