The update check pinned Mozilla's bundled roots, so behind a TLS-intercepting proxy
whose root lives only in the system store it failed with "invalid peer certificate:
UnknownIssuer". Downloads now trust the system's roots (keychain trust settings,
the Windows root store, the distribution's CA bundle) plus the bundled ones, which
cover a store that is missing or stale. Signature checks of builds are unchanged.

Assisted-by: claude-opus-5.5