Use our own CA for Imp as well?

From the "when your own code surprises you positively" department -- this department is rarely seen but it very occasionally makes an appearance:

I built this Registry thing which knows how to generate TLS certs with a local certificate authority, see https://github.com/jernst/feditest/blob/pr-generate-site-json/src/feditest/registry.py . For S2S tests on UBOS, the root cert needs to be in the system trust store so we don't have to figure out how to tell Mastodon and every app to run ignore certificate validity. I just wrote that code, and it also wants the Imp node to store that root cert! (I haven't done that yet.)

But that means we could get rid of insecure certs entirely by pointing the Imp to that extra source of trust. I am tempted to say we should do that.

We wouldn't have to mess with the trust store on the system that runs feditest, but could simply provide it as an extra trust source to the httpx client (which I assume can be done).