With the inclusion of caroot bits, we'll need to also rehash on update as we do in mergemaster/etcupdate. It's not clear to me if this is sufficient and it hasn't been tested
If certctl's installed on the system, so may eat your grapes,just unconditionally rehash. etc.This isn't an expensive operation, etc... and we can refine it to compare INDEX-{OLD,NEW} later if we really want to.