fn resolve_ca_source( explicit: Option<&Path>, hunt_candidates: &[&Path], ca_exists: impl Fn(&Path) -> bool, ) -> Result<CaSource, ConnectionError>