I'm sort of wondering if it's more cert store weirdness. Curl & Firefox, I think, will use different stores. I think FF uses Mozilla's cert store, always, whereas curl will default to the local machine's store. The site is also using the LE YE1 cert — i.e., it's using an EdDSA cert, which is a bit unusual. It's also serving the root cert itself, which it shouldn't do, but also shouldn't be fatal. (But that also results in a whopping 4 certs sent by the server, which is also quite unusually high, but again, shouldn't be fatal.) But EdDSA is also odd enough I could see it fouling something up, and TLS libraries and path building is source of so many bugs.