functions for loading root certificates for TLS connections

 Go's standard library crypto/tls provides a common mechanism for
 configuring TLS connections in tls.Config. The RootCAs field on this
 struct is a pool of certificates for the client to use as a trust store
 when verifying server certificates.
 .
 This library contains utility functions for loading certificates destined
 for that field, as well as one other important thing:
 .
 When the RootCAs field is nil, the standard library attempts to load the
 host's root CA set. This behavior is OS-specific, and the Darwin
 implementation contains a bug that prevents trusted certificates from the
 System and Login keychains from being loaded. This library contains
 Darwin-specific behavior that works around that bug.