pub fn system_roots() -> Vec<Vec<u8>>
DER-encoded root certificates from the OS store (empty where the OS has no such store or it cannot be opened).