Update fetch.1 and fetch.3 to reflect libfetch's actual use of CA bundles

[grembo]

Summary

r266291 and r294326 changed the lookup algorithm of CA cert bundles in
libftech, but the man pages were not adapted. This patch is an attempt to fix
this.

As both changes have been MFCed and subsequently MFHed to releng/10.3
(r266632 and r295843), I'd suggest to get those changes into 10.3 before
release.

Also did some minor fixes as suggested by igor.

Test Plan

igor
mandoc -Tlint

[grembo]

Also document the fact that SSLv3 is disabled by default now.

[grembo]

Add two missing environment variables.

fetch(1) should probably be updated to provide command line switches
for those new features, but as this would be a functional change, it
doesn't belong into this review (as it's supposed to be MFCed/MFHed).

[wblock]

lib/libfetch/fetch.3

403 ↗

(On Diff #14104)

Probably better to say

If neither file exists, and

406 ↗

(On Diff #14104)

Maybe s/apply/are used/ is clearer?

407 ↗

(On Diff #14104)

Does "may" here mean "it is allowed to" or "it might"?

Maybe just s/may/can/ is correct?

541 ↗

(On Diff #14104)

The \& might not be needed at all.

As far as "e.g.", how about just "like" instead?

and message, like "File is not available (404 Not Found)"

usr.bin/fetch/fetch.1

142 ↗

(On Diff #14104)

As above:

If neither file exists and no CA path has been configured,

143 ↗

(On Diff #14104)

s/apply/are used/ ?

144 ↗

(On Diff #14104)

s/may/can/ (or "might", depending on what this is trying to say).

145 ↗

(On Diff #14104)

Swap this around, not "The port security/ca_root_nss" but "The security/ca_root_nss port".

230 ↗

(On Diff #14104)

Break the sentence instead of using a comma:

SSLv3 is disabled by default.
Set

231 ↗

(On Diff #14104)

No comma needed here.

[grembo]

Changes based on review.

[grembo]

lib/libfetch/fetch.3

406 ↗

(On Diff #14104)

They are not really actively used by fetch, but it's more like "OpenSSL does whatever it thinks is best" (I took this from the source and/or commit).

541 ↗

(On Diff #14104)

I prefer that as well.

usr.bin/fetch/fetch.1

143 ↗

(On Diff #14104)

see above

[wblock]

lib/libfetch/fetch.3

439 ↗

(On Diff #14360)

s/In case/When/ is simpler. But it should also be more explicit:

When a PEM-format key is in a separate file from the client certificate, the environment variable

441 ↗

(On Diff #14360)

can be set to point to the key file.

(PEM format has already been specified.)

[grembo]

More updates based on @wblock's input.

[wblock]

I like it. It's a full-bodied patch that has hints of cinammon, a delicate contrast between text and background, a smooth brainfeel, and a sweet finish. I would allow this patch to walk my dog or be ignored by my cat. 5/5, would buy again.