ca-certificates:
- update to 2026.03.19
- install to /etc/cacert
- extract individual ceritificates from the bundle
openssl:
- depend on ca-certificates
- install hashed symlinks to individual certs
curl:
- don't depend on ca-certificates; openssl handles this
- set both ca-bundle and ca-path