previously it was always overwritten with SBELT for root + root TA
doesn't have to be in cache (it's in trust store)