Update the CA; pin on GlobalSign's root

With this change, all existing installs will be updated to pin GlobalSign's root CA. We use that to fetch plugins from fred but also in the last-resort update scripts