Oh, I get it... the truststore is what has the CA cert.  I think our init code for the jks path supports a nil keystore, but our init code for the pem path doesn't support a missing cert/key.  So I think this test will have to keep using the jks path for now, and I will just need to *not* use "default-options-for-https".