@filippo I am finding that I can clone these with Git on Ubuntu 24.04 despite having upgraded the ca-certificates package and curl successfully passing the test.

I am not sure why; an strace of git reveals that it's reading certs from /etc/ssl, but I haven't dug in further than that yet. If I try running from an Ubuntu 24.04 container, either an up to date one or an older one where I have to update the ca-certificates package, it successfully passes the test by refusing the cert. But on my main workstation, it's failing and still pulling. Continuing to investigate why.