I believe this can be solved by adding the root CAs to the kapp-controller pods.

Generate a ca-certificates.crt file with the contents of all CAs to be trusted.

rm -f ca-certificates.crt
cat rootCA.crt >> ca-certificates.crt
# Repeat for all trusted CAs

Load the certificate bundle into Kubernetes and update the kapp-controller deployment to include it in all pods.

kubectl create -n tkg-system configmap kapp-controller-ca-certificates --from-file=ca-certificates.crt

cat <<EOF | kubectl patch -n tkg-system deployment/kapp-controller --patch-file=/dev/stdin
spec:
  template:
    spec:
      containers:
      - name: kapp-controller
        volumeMounts:
        - mountPath: /etc/ssl/certs/ca-certificates.crt
          subPath: ca-certificates.crt
          name: ca-certificates
          readOnly: true
       volumes:
       - configMap:
           name: kapp-controller-ca-certificates
         name: ca-certificates
EOF 

The kapp-controller pods will restart with the new configuration and should start working. You can follow the kapp-controller logs for more details.

kubectl -n tkg-system logs -f deployment/kapp-controller