code: def pick_trust_for_twisted(netloc, possible):
      
      try:
          trust_cert = possible[netloc]
      except KeyError:
          return None
  
      cert = ssl.Certificate.load(trust_cert.as_bytes(), FILETYPE_PEM)
      return ssl.trustRootFromCertificates([cert])
docs: Pick the right "trust roots" (certificate authority certificates) for the
      given server and return it in the form Twisted wants.
  
      Kubernetes certificates are often self-signed or otherwise exist outside
      of the typical certificate authority cartel system common for normal
      websites.  This function tries to find the right authority to use.
  
      :param NetLocation netloc: The location of the server to consider.
      :param dict[pem.Certificate] possible: The available certificate authority
          certificates from which to choose.
  
      :return: A provider of ``twisted.internet.interfaces.IOpenSSLTrustRoot``
      if there is a known certificate authority certificate for the given
      server.  Otherwise, ``None``.