pub const kSecTrustOptionAllowExpiredRoot: SecTrustOptionFlags = 0x0000_0008;