* debian/pollinate.default:
  - use curl --capath /dev/null by default, to mitigate SSL CA MitM
    attacks, since we're shipping our own public cert
releasing 4.2
opening 4.3