PKI library Mac trust store integration

net/data/ssl/certificates/README

 This directory contains various certificates for use with SSL-related
 unit tests.
 
 ===== Real-world certificates that need manual updating
 - google.binary.p7b
 - google.chain.pem
 - google.pem_cert.p7b
 - google.pem_pkcs7.p7b
 - google.pkcs7.p7b
 - google.single.der
@@ skipping 286 matching lines @@
 - multi-root-chain1.pem
 - multi-root-chain2.pem
      Two chains, A -> B -> C -> D and A -> B -> C2 -> E (C and C2 share the
      same public key) to test that certificate validation caching does not
      interfere with the chain_verify_callback used by CertVerifyProcChromeOS.
      See CertVerifyProcChromeOSTest.
 
 ===== From net/data/ssl/scripts/generate-multi-root-BFE-keychain.sh
 - multi-root-BFE.keychain: An OSX Keychain containing the generated
   certificates "multi-root-B-by-F.pem" and "multi-root-F-by-E.pem".
+- multi-root.keychain: An OSX Keychain containing the generated
+  certificates multi-root-*-by-*.pem
 
 ===== From net/data/ssl/scripts/generate-duplicate-cn-certs.sh
 - duplicate_cn_1.p12
 - duplicate_cn_1.pem
 - duplicate_cn_2.p12
 - duplicate_cn_2.pem
      Two certificates from the same issuer that share the same common name,
      but have distinct subject names (namely, their O fields differ). NSS
      requires that certificates have unique nicknames if they do not share the
      same subject, and these certificates are used to test that the nickname
@@ skipping 11 matching lines @@
      aia-cert.pem has a caIssuers that points to "aia-test.invalid" as the URL
      containing the intermediate, which can be served via a URLRequestFilter.
      aia-intermediate.der is stored in DER form for convenience, since that is
      the form expected of certificates discovered via AIA.
 
 ===== From net/data/ssl/scripts/generate-self-signed-certs.sh
  - self-signed-invalid-name.pem
  - self-signed-invalid-sig.pem
      Two "self-signed" certificates with mismatched names or an invalid
      signature, respectively.