Mint trusts the OTP CA store, which comes from the OS. Load the CAStore bundle into it when Finch starts, so Finch trusts the same roots as the other adapters.