Before this, make-ca does not verify the certificate of hg.mozilla.org
at all. It makes sense as make-ca often runs on systems without trust
anchor. But, a MIM can easily fake hg.mozilla.org and completely hijack
the trust anchor of a BLFS system.
To improve the situation, we ship the certificate of the CA root for
hg.mozilla.org (DigiCert Global Root CA) in the make-ca package, and use
it to verify hg.mozilla.org.
