It would be useful if the self-signed cert for trusted.ci were for the actual trusted.ci.jenkins.io host name, even if self-signed.

That would allow us to run curl --cacert with a local copy of the cert, without having to actually access the ec2.internal host name, and tie ourselves to that infra detail.