Comment 8 for bug 833994

FWIW, on certificates, the best way to approach this would probably be to use the fact that you can concatenate two initramfses; so we'd probably have to have a tool that builds certificates into initramfs form so that you can append that to your installer initrd, or deliver it separately if your boot loader supports multiple initramfses.