The appended scriptlet does come from the kernel. It's not apparent to me why it's done the way it is instead of calling an external script with the list of certificates to enroll.