This was added because of compatibility issues on many common installations, in which curl didn't have access to a reasonable list of root certificates (in particular for github). I am wondering if this is still an issue now ?

We still double-check md5s of course.