GnuTLS tries to use /usr/local/share/certs/ca-root-nss.crt. Instead of
maybe using it if it is already installed or if the P11KIT option is selected
(which depends on ca_root_nss), just always depend on ca_root_nss.

Reported by: Tatsuki Makino