code: func getRootCAsForHost(c *Client, host string) *x509.CertPool {
  	// don't init pool, want to return nil not empty if none found; init only on successful add cert
  	var pool *x509.CertPool
  
  	// gitconfig first
  	pool = appendRootCAsForHostFromGitconfig(c.osEnv, c.gitEnv, pool, host)
  	// Platform specific
  	return appendRootCAsForHostFromPlatform(pool, host)
  }
docs: // getRootCAsForHost returns a certificate pool for that specific host (which may
  // be "host:port" loaded from either the gitconfig or from a platform-specific
  // source which is not included by default in the golang certificate search)
  // May return nil if it doesn't have anything to add, in which case the default
  // RootCAs will be used if passed to TLSClientConfig.RootCAs