can we remove the additional key of service here?
I guess the `SERVICES` and `TRUST_ROOTS` are good as the top level elements.
(The registry is the *service* registry anyway).