This is desirable in order to have certificate generation be managed by Bazel. In order for caching to work correctly, Bazel expects its targets to be hermetic, meaning given the same build inputs, the targets produced should be the same. Also, since we are generating certificates as part of the build process, we need it to work on all platforms which we build on. s390x and PPC may be difficult customers here; if it's too hard, we may not support local certificate generation on these platforms.