Add option to load and hash cacert

The --updateall option is required to create a hashed symlink to the cacert.