adding note to readme; we should manage the (trusted) root CAs on the system