Put the certs in the program directory. If malware makes it to that point then you will have lost the battle in any reasonable threat model.