I got it working and commented over at How to validate a certificate from JS/TS - #19 by skilesare
I think I thought that the agent was pulling the root from mainnet because I didn’t specify a host and I was using agent.fetchRootKey to get it(it may have been from main net). (I’m not quite sure because I found out all the keys start with the same prefix),I figure out that I needed to specify the host but that didn’t seem to work because, as you say, no HTTP agent. Eventually I figured out that I use NNS state I need to get the pub key of the nns subnet and if I only have a singe app subnet I can use that pub key. Code is working here: icrc75.mo/pic/icrc75/list.test.ts at 4899454fdf3f544376a4c116c1627279c6e2b901 · icdevsorg/icrc75.mo · GitHub