Please add ca-netboot-xyz.crt to version management

[zhangyoufu]

Is your feature request related to a problem? Please describe.
The ca-netboot-xyz.crt is the trust anchor for this project. It is resonable to check https://boot.netboot.xyz/sigs/menu.ipxe.sig against this CA cert before chainloading. I am not aware where I can find this CA certificate, except extracting it from .sig files.

Describe the solution you'd like
Add ca-netboot-xyz.crt and codesign.crt into this repo, so that whoever interested in chain of trust could find and consume them more easily.

Describe alternatives you've considered
Something like https://ca.ipxe.org ? netboot.xyz does not cross-sign WebPKI root CAs, so may be too heavy.
But make the CA cert available via http/https URL is still helpful.

Additional context
ca-netboot-xyz.crt is about to expire on Jan 28 16:37:31 2026 GMT. Could you please schedule a rotation and annouce it?