With rustls it's easier to embed the root CA certificates inside
the compiled binary itself using the webpki-roots crate. We need to
do this because it's the easiest way of getting TLS certificate
validation working inside the initramfs where /etc/ssl/certs or
else does not exist.