`curl -k` doesn't do any of that. It just connects via TLS and does no checking whatsoever on the remote server's identity. And what you're saying about CA cer

`curl -k` doesn't do any of that. It just connects via TLS and does no checking whatsoever on the remote server's identity. And what you're saying about CA certs has no resemblance to reality. People don't look at certs by matching their public keys exactly to what they expect... they trust certificate authorities to make that determination for them. But again, `curl -k` does neither so I don't think your point applies regardless.