I'm using megatools instead, which open source.
I guess update-ca-certificates doesn't actually look at /usr/share/ca-certificates, I just had a symlink floating around.
These are defunct, nobody should be using anything that old.
I never ended up using this.
This didn't have a Manifest and doesn't build (though it was just missing a listed dependency, so I didn't try hard). Regardless, I didn't end up using it so it's defunct for me.