Could we propose copying the system keystore and then adding certs to your local copy, rather than recommending that they muck with the system one?

Also, is there truly no way to specify a custom keystore file besides the global system properties that are referenced in the pg jdbc client docs?  If not, that sucks.  And we also might need to give some pointers on where they would actually set those command line arguments to java (probably /etc/default?)