Install ca_root_nss before fetching from GitHub