Remove hard certifi dependency and document.

As discussed in #2124.
maybe link to the trust store?