There is a difference in documented and thus expected behavior (yes, call it a bug). The agent updater currently only obeys certificates in the bundled certifi bundle or alternative certificates baked in via bakery configuration.
We are working on this. But it seems there is no quick solution in sight, since a lot of environments have to be considered (for example Python update script vs. bundled updater, Linux vs. Windows and so on).
Please use the first point in “Certificates via Agent Bakery” as workaround for now:
We’ll update “Certificate Store” as soon as we can guarantee consistent behavior across all operating systems.