Template suggestions/management w/ internal CA certs

We are wrapping up our upgrade from 1.22.x to 3.3.0 and trying to clean up our templates. One of the things we’d like to do is try and reduce our dependency on forking the kickstart template. We have a internal CA that is used for access to the internet (and internal resources) so need to inject our CA certs into the newly installed OS. Previously we’ve been forking the template and adding this in at the start of the %post section.

I am focusing on the OS install here and ignoring puppet. We are currently split (multiple instances) with one using an intermediate and are trying to determine what the requirements actually are there.

How are others handling this? Would you be open to a template update that added a snippet_if_exists(template_name + "custom post early") at the start of the post section?

TFM: 3.3.0
OS: CentOS 7.9; will be looking to start provisioning Alma/Rocky soon