Lots of changes to dynamically load trusted certs only as necessary, to properly configure http clients every time, etc #453 #473