Doesn't distroless bring in a lot of complexity when you need something as simple as ca-certificates?

IMO Distroless or even scratch is nice for statically complied binaries or self contained deployments, but if there's a dependency on user space then it becomes complex.