That's a pretty interesting approach. Might even work! I wonder if something simple (and stupid) like an LD_PRELOAD with an alternative fixed SSLVerifySignedSe

That's a pretty interesting approach. Might even work! I wonder if something simple (and stupid) like an LD_PRELOAD with an alternative fixed SSLVerifySignedServerKeyExchange would work. Won't work if the code ends up getting inlined. Guess not, looks like SSLVerifySignedServerKeyExchange is static.