allow untrusted certs for fixed-output derivations