Apple can fix this by building curl with SecTrust [1].

[1] https://eissing.org/icing/posts/curl-apple-sectrust/