uclient-fetch: only add default CA entries if no certificate was supplied and verify...