After several hours of looking and using fs_usage to trace files, I have come to the conclusion that the certificates are indeed stored in the keychain. (which in hindsight is a DUH moment).
Here are the files iTunes reads on launch and during a sync on my mac.
18:38:16.776 stat64 /Library/Keychains/System.keychain 0.000010 iTunes 18:38:16.776 open F=5 (R_____) /Users/me/Library/Keychains/login.keychain 0.000007 iTunes 18:38:16.801 open F=5 (R_____) /Library/Keychains/System.keychain 0.000016 iTunes 18:38:26.013 open F=48 (R_____) /System/Library/Keychains/SystemRootCertificates.keychain 0.000024 iTunes
I have been unable to uncover which specific keys or chain of keys are needed. I'll edit this answer once I eliminate these one by one and perhaps eventually a true answer will materialize.