Improve how pinned providers are handled

maybe use the `get_ca_cert_path` in `ProviderConfig`?