I would say it's more something like this: Use the provider CA cert for every request once we have it bootstrapped.