Previously, missing files would return a "corrupt metadata" error
because errors were not being properly handled in the S3 backend. This
change catches not found errors and passes them up to be handled
accordingly.
Alpine Linux puts the CA cert bundle at /etc/ssl/cert.pem by default; to
ensure that Go looks in that location, we now set the SSL_CERT_FILE
environment variable.