upgrade p11-kit and add trusted path to ca_root_nss certs
checksum fix for p11-kit