Currently p11-kit already use base-system certificates from /usr/share/certs
(since 8672992ef7f072f87304e953231de77179143f1d 2023-02-01 11:05:18 +0000).
Base system's certctl tool allows administrator to add locally trusted anchors
in /usr/local/share/certs, but p11-kit's current behaviour will ignore them.
I propose using system's consolidated certificates in /etc/ssl/certs and
/etc/ssl/untrusted instead of /usr/share/certs/trusted and
/usr/share/certs/untrusted.
These directories (/etc/ssl/ ones) are managed by system's certctl tool,
and reflects the same content plus admin's managed trusted/untrusted certs.
This change should not break any current behaviour on FreeBSD > 12.2.
This is also coherent with debian's behaviour (on debian, p11_trust_paths
is set to /etc/ssl/certs/ca-certificates.crt, updated by system's
update-ca-certificate which allows custom anchors listed in
/etc/ca-certificates.conf).
PR: 297759