This is a partial revert of [0]. For the bootstrap we only use the
release pocket, not updates or security, so the version of
ca-certificates we install initially is too old to verify current
LetsEncrypt protected hosts.
[0] I455568f1e261060aefe555e9f5b4ef0830b60157
Change-Id: I673bc0ec687df6db59911f17dae1d50cbc7e3dd6
ce68aa4e64