I think this will need some more documentation of what keys can be found in $trusted, and in what way they are "trusted" - your trust may not be the same as mine!  From what I understand, the keys there are trusted on the assumption that the client certificate is valid.  Would we ever add additional forms of trust?