No, it's a deficiency in the `pems->key-and-trust-stores` function in our KS/CA code.  We should fix it, but that's going to be a separate task from this.