trust anchors: support non-root TAs, one domain per file

function `add_file` is added as an alias to `config`,
but otherwise the interface is almost identical.