The TLS specification (RFC 8446) section 5.4 defines optional Record Padding.

As a security improvement, I suggest that curl implement random record padding.

Record padding is primarily applicable to server as a way to mitigate vulnerabilities such as CRIME and BREACH that involve compression and reflection. But, who knows - there may be some future vulnerability that random record padding will address on the client - it couldn't hurt :)

In OpenSSL, this is done using SSL_CTX_set_record_padding_callback