This is probably a stupid question: what is the correct way to update certificates if one has installed additional certs with update-ca-trust and the distro releases a new version of ca-certificates?