It’s possible to easily script it as part of your firstboot. I copy a certificate to /usr/local/share as part of my general support package (which is common across all images), and somewhere in my common firstboot I have this:

/usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /usr/local/share/the_certificate.cer

I’m also fairly clueless about certificates, but this has been what’s worked for me. I suppose it would be possible to have a postflight script that would run this command with the keychain path prepended with $3 so that it will point to the target volume in the InstaDMG build. Never tried that however.