the way I recall it working as of late is that you either leave the flag empty, in which case the system roots are used to evaluate trust, or you specify a cert, in which case system roots are ignored