$ 0 0 perl is not optional for ca-certificates, c_rehash is run by update-ca-certificates, which is called by the start-up script.