Add missing certs; pin git.overlays.gentoo.org