Make it possible to specify an alternate trust root from certifi.where()

[sergei-maertens]

Especially combined with our self-certifi library, we make the trust root bigger to add the G1 root certifcate. The certificate validation should accomodate this.

[sergei-maertens]

Some more discussion - probably this chain verification check is not relevant at all and is better removed.

[sergei-maertens]

Misunderstood feature in the trust store, we can basically do this by uploading a cert-only certificate with the custom/self-signed root certificate.