The ca-certificates triggers were added to deal with installation/upgrade problems in https://bugs.debian.org/537051
Do you have a suggested patch that also properly handles the issues presented in #537051? I would suggest that downloader packages possibly might pre-depend on ca-certificates, if that is required by the download, as a possible fix. I'm not sure if the trigger runs to completion first, as a pre-depend package. -- Kind regards, Michael