as per https://letsencrypt.org/2023/07/10/cross-sign-expiration.html
Letsencrypt is dropping support for Android <= 7 by removing cross signing.
to keep supporting older Android versions we need to bundle the root cert
ourselves. (Firefox for example does this too)
The KeyStore file is in BKS-V1 format. A good tools to edit the file is
https://keystore-explorer.org/
To keep the attack and bug surface as low as possible we only run the check
against the bundled keystore on Android <= 7
