Hmm, probably so. I ran into cases where I needed it for the brand install.

I'm beginning to like the idea of making certlib.UpdateAction.install install ent certs via something like
an ent_dir.add_cert_bundle(ent_cert_bundle). That would keep the entdir's in sync.