This might have compatibility implications, but I'd prefer to have it just error out if we get to this point.  Unless the implementation were going to do *both* (e.g., import the PEM-based certificates into the memory-based keystore and truststore), how do we know which ones are *correct*?