This will allow us to add a --no-roots option to hxtool copy-certificate which is convenient when copying certificate chains from stores that may include root CA certificates.