require certificate trust, fixes #4