Currently, we start each service with fixed acceptable root CAs.
We need to allow updates via the config-block to allow new peers to join the network (party).