plus side, i know a lot more about how the ca certs packages are supposed to work on debian. and i know a little more about how java's keystore works.