Currently, the FilterServiceProvider.Mac daemon can add its root certificate to the keychain. It cannot trust the root certificate automatically however. I suspect this has to do with clearing the trust settings dictionaries rather than changing them to what they need to be.