Already read, with an apparent bad assumption on my part. In this case, since the check's against the ccert's fingerprint, I'd assumed 'trusted' to mean "trusted if the fprint matches". Having added the ccert's fingerprint to a lookup table on the server seemed appropriate, similar to trust in openssh connection where a client's trusted once its pubkey is added to authorized_keys on the checking-server.
Prior to your posted explanation I did not understand that trust required a trusted CA -- either with built-in trust for standard commercial certs, or trust added by adding to the appropriate cert bundle on the server. The additional comment could have been of some help.
