Execute tls-ca-fetch against any public TLS server. The binary runs server-side; the PEM is returned to your browser.