cgo and non-cgo code paths can disagree
on the number of root certificates:
=== RUN TestSystemRoots
--- FAIL: TestSystemRoots (0.31s)
root_darwin_test.go:31: cgo sys roots: 93.605184ms
root_darwin_test.go:32: non-cgo sys roots: 213.998586ms
root_darwin_test.go:44: got 168 roots
root_darwin_test.go:44: got 427 roots
root_darwin_test.go:73: insufficient overlap between cgo and non-cgo roots; want at least 213, have 168
FAIL
exit status 1