style: use a polyvar for trust_anchor/fingerprint instead of two options
fail early if config is broken
style
use getenv HOME instead of gelogin/getpwnam/pw_dir