Find the encryption certificate for a recipient mailbox.
Find the signing certificate + private key for a signer mailbox.
The trust anchors used for certificate-chain validation.
Import a single certificate into the store.
Import the certificates (and CRLs) contained in the DER/PKCS#7 data.
The injectable X.509 certificate / private-key store. This is the environment seam: C2b ships an in-memory default, a browser (IndexedDB) store, and a Node (filesystem) store; tests supply a fixture store. Everything is async so a remote or IO-backed store fits without changing the abstraction.