fetchhg: allow untrusted certs (merge #540)

It's for fixed-output derivations, security provided by output hash.