only call get_trusted_certs at sfa aggregates.