GitHub's macOS runners are unfortunately still vulnerable to the eMudhra CA compromise, meaning that any TLS traffic that goes through the system Git, curl, etc. is MITMable.
(success in the CI matrix below means the runner made a TLS connection that it absolutely should not have.)
