Ah, I hadn't noticed that.  I'm pretty sure that the default HttpClient already does hostname verification, so as long as we're connecting to an https endpoint at the far end, its cert should get validated.  From what I can tell, the reason that the reason we provided our own LanternHostNameVerifier() was in order to trust the fallback server's cert, whose hostname and ips don't match how we're actually connecting to it.