use the trust binary instead of p11-kit to extract trust
don't remove symlinks to other locations in /etc/ssl/certs

As per discussion on the Factory list we should output a warning all the time instead of removing symlinks