pub fn trust_file_path() -> PathBuf
Path to the trust file under the active base dir. Caller is responsible for creating parent directories when writing.