My bet is the XProtect update mechanism could be used to update the certs.pem file.