I think we now have all the components to tackle the problem of trusted CA certificates in PKCS#12 keystores that were not created with the default Java PKCS#12 provider. The trusted certificate ...