docs: Add note about Root CA Certificate location with native scans (#2325)

* Add note about Root CA Certificate location with native scans

* Add note about Root CA Certificate location with native scans

* Add note about Root CA Certificate location with native scans

* Update datasources.md

Co-authored-by: Oleks V <[email protected]>

* address feedback

---------

Co-authored-by: Oleks V <[email protected]>

Author: andygrove

docs/source/user-guide/latest/datasources.md

@@ -175,6 +175,14 @@ The `native_datafusion` and `native_iceberg_compat` Parquet scan implementations
 
 This implementation maintains compatibility with existing Hadoop S3A configurations, so existing code will continue to work as long as the configurations are supported and can be translated without loss of functionality.
 
+#### Root CA Certificates
+
+One major difference between `native_comet` and the other scan implementations is the mechanism for discovering Root
+CA Certificates. The `native_comet` scan uses the JVM to read CA Certificates from the Java Trust Store, but the native
+scan implementations `native_datafusion` and `native_iceberg_compat` use system Root CA Certificates (typically stored 
+in `/etc/ssl/certs` on Linux). These scans will not be able to interact with S3 if the Root CA Certificates are not
+installed.
+
 #### Supported Credential Providers
 
 AWS credential providers can be configured using the `fs.s3a.aws.credentials.provider` configuration. The following table shows the supported credential providers and their configuration options: