Change SoupSessionAsync::ssl-use-system-ca-file's default in libsoup 2.x
It looks like a number of projects (referenced in libgrss#4) got it wrong in GNOME itself, so I can't imagine this not being a problem downstream as well.
It would certainly be better to change the default rather than expect all existing users to get it right. Worst case scenario, it will make TLS validation be stricter, a problem which can be easily fixed with server-side changes.