Long build times when cacerts dirties the cache

I noticed our 8.13 RC3 packages were taking over 40 minutes to build. When I went to look at https://dev.gitlab.org/gitlab/omnibus-gitlab/builds/177687, I saw:

 [Software: cacerts] I | Could not restore from cache
              [NetFetcher: cacerts] I | Cleaning project directory `/var/cache/omnibus/src/cacerts/cacerts-2016.09.14'
              [NetFetcher: cacerts] I | `/var/cache/omnibus/cache/cacert.pem' is not an archive - copying to `/var/cache/omnibus/src/cacerts/cacerts-2016.09.14'
                 [Builder: cacerts] I | Starting build

Presumably our cache gets invalidated each time cacerts gets updated. Is this really necessary?

It looks like openssl depends upon cacerts, but perhaps we can decouple that dependency to avoid having to rebuild everything?