add postrm and call update-ca-certificates in postinst