Merge "Make app installed cert flags persistent" into mainline-prod