people have distributed certs with e.g. Puppet in the past, which doesn't store in the keychain, or SCEP, which... can. I would think you'd need middleware to make a keychain cert accessible to a process like osquery, but we haven't used direct TLS so I can't speak to that exact deployment type