Boulder should install nss (certificates) automatically when using `networking: yes`

[livingsilver94]

[joebonrichie]

long term this should probably come from a dedicated ca-certs pkg i guess.

[sunnyflunk]

I'm open to discussion (it will definitely be renamed to a real subpackage, we don't actually build nss), but I quite like building it as part of nss, which gets updates semi regularly so we always keep bumping the certs. If there was needed an urgent change, they'd probably make a new release as these are used for firefox.