I've read it doesn't download the certificate.
I thought the cert wasn't provided on NUS if the game wasn't bought, but NUSGrabber actually download the cert?
I changed the first post to recommend NUSGrabber instead of JNUStool.
That's also why people have the "you can't install game you didn't buy" error message, it's missing the cert, so the WUP installer think you try to install a game you didn't buy (because game you didn't buy are missing files, like the tiket or the cert).
It's not an Anti-piracy function, it's a BAD message choice. It should say "you are missing a file" instead to be more precise about the error, instead of supposing the user is pirating.