Comment by israrkhan

This is mind blowing. if such a huge majority uses their hosted CA bundle, that makes curl a very attractive target. All under the control of a single individual (I am not questioning his integrity, just saying too much reliance on a single project/individual). We have seen such examples in past (e.g openssl)