Verify peer certificates when fetching tarball