Quick note: The "TRUSTED CERTIFICATE" PEM format is not yet supported by any IWD version. Do you know of a place where this format is documented? I seem to remember I looked at adding support for loading such files in ell (for IWD use) but I couldn't find any documentation on the format. There's no problem with adding the support but we'd prefer not to have to reverse engineer it from the openssl code and IIRC the openssl commit that first added it offered no clues on what it's for.
Best regards
