Alternatively, how about printing an error in crypt32 itself if no trusted root certificates are found? That way applications get the same benefit, not just the test suite? E.g., how we do for ntlm_auth in secur32?
That sounds like a good approach. --Juan