...
TrustManagement is "bootstrapped" in the software using MetaData. That is, MetaData is implicitly trusted once a lookup is successful, and it provides the rules that drive the various TrustEngines provided with the software. There is a distinct API that can supply alternate TrustEngines, and they may choose to implement other mechanisms for obtaining such rules.