The trust-connect-host feature relies on mucking with curl's openssl context. On Mac this feature doesn't work, because the system curl is not built with openssl, and Homebrew's default version of curl is not built with openssl either. Ideally there would be a way to do a custom cert host check using curl and the Mac security framework.