anchor.diff:          browser = command.split()[0]
           with subtest("Good certificate is trusted in " + browser):
               execute_as(
  -                "alice", f"env P11_KIT_DEBUG=trust {command} https://good.example.com & >&2"
  +                "alice", f"{command} https://good.example.com >&2 &"
               )
               wait_for_window_as("alice", browser)
               machine.wait_for_text("It works!")
  
positive.code:             execute_as("alice", "xdotool key ctrl+w")  # close tab
  
          with subtest("Unknown CA is untrusted in " + browser):
              execute_as("alice", f"{command} https://bad.example.com & >&2")
              machine.wait_for_text(error)
              machine.screenshot("bad" + browser)
              machine.succeed("pkill " + browser)
    '';
  })
  
negative.code:       # chromium-based browsers refuse to run as root
        test-support.displayManager.auto.user = "alice";
        # browsers may hang with the default memory
        virtualisation.memorySize = 600;
  
        networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
        security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
  