I suspect the rustls-ffi numbers would look even better using curl w/ --ca-native on MacOS/Windows/etc where we can lean on rustl-platform-verifier to avoid all the PEM parsing & trust anchor construction for the big pile of system roots needed at startup on Linux.