This was much harder than it needed to be, because Arcanist is dead set
on forcing a CA bundle instead of letting curl pick one or use the OS
native trust store. The correct solution is to remove a ton of code,
the simpler one is to teach Arcanist's HTTP library how to handle CA
paths and make https.cabundle default to FreeBSD's native trust store.