I'm going to rationalize those things.  The naming is crazy.  I'm going to
rename them to something like /sys/lib/x509/cert and /sys/lib/x509/thumb.
I think you had it in the right place given the way ehg was using it
here but even he admits the naming is meaningless.