both mbedtls and openssl doesn't actually check self-signness of turst anchor, so one can remove signeture from root certificates and reduce file size while keep compatablity. in current version this would save about 60kB (223kb current, 158kb without signture) but not sure if this is something worth making new package for