It looks like http-kit uses that same API, a key in the options map called ":insecure?".  I think it may default to `true`.  Perhaps we should change clj-http-client to default it to "false"?