When we do "pacman -update CA-Certificates" the .r0 files must be preserved.
Most of our effort is going into the new vdt-update-certs script, so I'm
not worried about being fancy. I say we just copy all .r0 files from the
old location to the new one. (vdt-update-certs only preserves them if we
continue to have the CA.)
There is a Bourne shell script in this package where this will fit.