At the moment the ca is removed as soon as a connection https is established, but we could actually keep it in place if we remove the private key. This way even if one refused to install the certification authority it could install it later.

See #189