short-circuit local installs but fall back less
docs: document cafile config setting