Fix security bug: collect certs for non-systemDir apks.

ag/3340390 changed untrusted value to systemDir while going through
code review, flipping the meaning of the variable, but this was not
reflected in the call site.  As a result, systemDir apps are the
only ones being fully verified, which is the opposite of what we want.

Test: Builds, eventually CTS.

Change-Id: I585ac65c957f0d8db6c73f003d3a3eb2b79c8883