The authority makes its own root at first start, and the proxy fetches it through a gate

step-ca's root certificate, its key and that key's password were own secrets — random
bytes the mesh minted, which no certificate is (novox/hq 04-ISSUES/076). The mesh
mints only the CA password now; step-ca makes its root at first start and serves it
at /roots.pem, which the manifest now names beside the ACME directory. The route
proxy fetches that root over the mesh network in a run-once step before it starts,
instead of being handed a served fact that could only be written before anything ran
(ADR 0098).

modules/route-proxy/module.json

@@ -62,19 +62,31 @@
       "path": "/var/lib/route-proxy/ca",
       "mode": "0755"
     },
-    {
-      "id": "ca-bundle",
-      "type": "file",
-      "path": "/var/lib/route-proxy/ca/root.crt",
-      "mode": "0644",
-      "content": "${bound:acme-ca:root}\n"
-    },
     {
       "id": "acme-env",
       "type": "file",
       "path": "/var/lib/route-proxy/acme.env",
       "mode": "0600",
-      "content": "ACME_DIRECTORY=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:path}\n"
+      "content": "ACME_DIRECTORY=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:path}\nACME_ROOTS=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:roots}\n"
+    },
+    {
+      "id": "trust",
+      "type": "container",
+      "name": "route-proxy-trust",
+      "run-once": true,
+      "image": "alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b",
+      "network": "host",
+      "env-file": [
+        "/var/lib/route-proxy/acme.env"
+      ],
+      "volumes": [
+        "/var/lib/route-proxy/ca:/ca"
+      ],
+      "args": [
+        "sh",
+        "-c",
+        "wget -q --no-check-certificate -O /ca/root.crt \"$ACME_ROOTS\" && test -s /ca/root.crt"
+      ]
     },
     {
       "id": "server",