certctl: Unstickify (un)trusted certificates

[des]

Summary

Ever since certctl was rewritten in C, the rehash command has reingested
TRUSTDESTDIR / UNTRUSTDESTDIR in addition to TRUSTPATH / UNTRUSTPATH.
This seemed like a good idea at the time but was, in retrospect, a
mistake, as it means a (un)trusted certificate remains (un)trusted
forever (or at least until it expires) even if it is removed from
(UN)TRUSTPATH. Among other issues, it causes ports QA to fail for any
port that either installs certificates or depends on a port that does.

Although this behavior was undocumented, the change may surprise users
who have added certificates manually, so update the manual page to point
it out and add prominent warnings to the trust and untrust commands.

PR: 290078
MFC after: 1 week

[des]

untrusted as well

[des]

documentation

[bcr]

OK for the changes to the manpage.

[des]

unbreak list command

[kevans]

usr.sbin/certctl/certctl.8

116

Reading the caveat here, I guess I'm wondering why untrust doesn't act as a slightly nicer shorthand for copying the cert into one of the default_untrusted_paths (probably the localbase one?) rather than accidentally presenting a footgun, since we do some implicit rehashes (e.g. when the trust store changes) that they may not be considering that will drop it.

[des]

usr.sbin/certctl/certctl.8

116

I'm torn between a) changing certctl untrust to doing just that and b) leaving the code as-is but documenting that as the preferred alternative.

[des]

add warnings

[des]

don't switch to distrust yet

[des]

add commas