code: func rootCertPool(caData []byte) *x509.CertPool {
  	// What we really want is a copy of x509.systemRootsPool, but that isn't exposed.  It's difficult to build (see the go
  	// code for a look at the platform specific insanity), so we'll use the fact that RootCAs == nil gives us the system values
  	// It doesn't allow trusting either/or, but hopefully that won't be an issue
  	if len(caData) == 0 {
  		return nil
  	}
  
  	// if we have caData, use it
  	certPool := x509.NewCertPool()
  	certPool.AppendCertsFromPEM(caData)
  	return certPool
  }
docs: // rootCertPool returns nil if caData is empty.  When passed along, this will mean "use system CAs".
  // When caData is not empty, it will be the ONLY information used in the CertPool.