After several hours of looking and using `fs_usage` to trace files, I have come to the conclusion that the certificates are indeed stored in the keychain. (which in hindsight is a DUH moment).

Here are the files iTunes reads on launch and during a sync on my mac.

<pre>18:38:16.776  stat64                                 /Library/Keychains/System.keychain                                                      0.000010   iTunes              
18:38:16.776  open              F=5        (R_____)  /Users/me/Library/Keychains/login.keychain                                            0.000007   iTunes              
18:38:16.801  open              F=5        (R_____)  /Library/Keychains/System.keychain                                                      0.000016   iTunes              
18:38:26.013  open              F=48       (R_____)  /System/Library/Keychains/SystemRootCertificates.keychain                               0.000024   iTunes              </pre>

I have been unable to uncover which specific keys or chain of keys are needed. I'll edit this answer once I eliminate these one by one and perhaps eventually a true answer will materialize.