Certificates are an APEX module now (which is the crux of authors complaints actually), which means they're updated out of band by Play Services and don't need

Certificates are an APEX module now (which is the crux of authors complaints actually), which means they're updated out of band by Play Services and don't need an OS update from OEM.