switch from curl-ca-bundle to OSX keychains, fix #1566