add trusted key store

GDI, of course I was confusing "root" and "system"

Let me try again: `Delete*System*` => `Mask*System*`