yum/rpm Failed to initialize NSS library in chroot
Special thank you to TrevorH and jhodrien on #centos.
The problem was that chroot prevents access to /dev/urandom (as desgined). The update installed to succeeded required those random bits to initialize GnuTLS.
The solution is:
mount -o bind /dev dev/
to the chroot and proceed with the update as usual.
Or if you don't want to mount the entire /dev directory, you may create your own!
mknod -m 666 /dev/random c 1 8 mknod -m 666 /dev/urandom c 1 9