having to generate a pem or der file and include it into the binary is honestly a little janky, and interacts poorly with things like Nix; it would be great to have some examples using webpki-root-certs or webpki-roots to provide the certificates instead.