rework setup, add mozilla trusted roots