Not sure if you're being snarky, but obviously this is very very important. It'd be entirely reasonable for someone to create a script that is meant to only us

Not sure if you're being snarky, but obviously this is very very important. It'd be entirely reasonable for someone to create a script that is meant to only use the internal private CA. When you run this command then you KNOW that you are ONLY talking to an internal corporate resource, because this is an internal corporate CA. And then apple adds a backdoor the size of domain validation, to this. Hell, it'd be entirely valid to use a dummy name, and just rely on the fact that it's signed by the corp CA, to establish that you are connecting to a corporate server. Now Apple's added a security vulnerability to that, by breaking this extremely reasonable assumption. Not cool.