pub fn native_roots() -> Result<Arc<RootCertStore>, NativeRootsError>Expand description
Return the cached system trust store, loading it on first call.
Concurrent first calls are serialised by the OnceLock barrier,
so the OS keychain sees exactly one load attempt per process even
under reload pressure that builds many fingerprints in parallel.
§Errors
Surfaces the load attempt’s error (sticky for the lifetime of the process). Restart the process to retry.