So just to repeat, currently osquery is using whatever set of certificate stores of the user the process itself is running as.