lemme show you 140,000 (!) places in code where certificate verification is switched off when using libcurl: https://github.com/search?q=CURLOPT_SSL_VERIFYPEER%2C+FALSE&type=code
@mittorn @PinoBatch @bagder TOTP does not require connection. Codes are generated offline, and you can use open source software like Aegis for the purpose.