Add migration from CaCert NSS nicknames to PEM.

chromeos/cert_loader.h

Index: chromeos/cert_loader.h
diff --git a/chromeos/cert_loader.h b/chromeos/cert_loader.h
index 69e31916447d916d4728c8bd9bd202d444e458c6..284d0c3dd7f5c06334fc91724b6501a34d8d0875 100644
--- a/chromeos/cert_loader.h
+++ b/chromeos/cert_loader.h
@@ -54,7 +54,9 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer,
   };
 
   // Sets the global instance. Must be called before any calls to Get().
-  static void Initialize();
+  // |task_runner| is the task runner that any slow calls will be made from,
+  // e.g. calls to the NSS database.
+  static void Initialize(const scoped_refptr<base::TaskRunner>& task_runner);
 
   // Destroys the global instance.
   static void Shutdown();
@@ -66,7 +68,7 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer,
   static bool IsInitialized();
 
   // |crypto_task_runner| is the task runner that any synchronous crypto calls
-  // should be made from. e.g. in Chrome this is the IO thread. Must be called
+  // should be made from, e.g. in Chrome this is the IO thread. Must be called
   // after the thread is started. Certificate loading will not happen unless
   // this is set.
   void SetCryptoTaskRunner(
@@ -95,7 +97,7 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer,
   const net::CertificateList& cert_list() const { return cert_list_; }
 
  private:
-  CertLoader();
+  explicit CertLoader(const scoped_refptr<base::TaskRunner>& task_runner);
   virtual ~CertLoader();
 
   void Init();
@@ -167,6 +169,9 @@ class CHROMEOS_EXPORT CertLoader : public net::CertDatabase::Observer,
   // TaskRunner for crypto calls.
   scoped_refptr<base::SequencedTaskRunner> crypto_task_runner_;
 
+  // TaskRunner for slow tasks.
+  scoped_refptr<base::TaskRunner> worker_pool_task_runner_;
+
   // This factory should be used only for callbacks during TPMToken
   // initialization.
   base::WeakPtrFactory<CertLoader> initialize_token_factory_;