To suppress the keychain system popup for GP 5.2.x you need to export
the PaloAltoCA from keychain, upload it in a configuration profile with
cert payload, mark it as Allow apps to access and scope it to your
device(s). This isnt documented anywhere ...
