The most precise way to do this is to set the "migrate" property to "no" in the following two lines of your generated Config.xml file:
<component displayname="Microsoft-Windows-Crypto-keys" migrate="no" ID="http://www.microsoft.com/migration/1.0/migxmlext/cmi/microsoft-windows-crypto-keys/microsoft-windows-crypto-keys/settings"/>
<component displayname="Microsoft-Windows-CAPI2-certs" migrate="no" ID="http://www.microsoft.com/migration/1.0/migxmlext/cmi/microsoft-windows-capi2-certs/microsoft-windows-capi2-certs/settings"/>
