Explicit application-provisioned root for one RICAL provider.
DER certificate encoded as unpadded Base64URL.