But it's not if you trust the url and curl has `--proto '=https' --tlsv1.2` as args