See #114 (comment). Synopsis:

• conda-forge builds Julia against OpenSSL instead of MbedTLS
• when build against OpenSSL, leaving CURLOPT_SSL_VERIFYHOST on as we do now causes the wrong host test to fail — this is what we would expect since we have told libcurl to allow hosts that it cannot verify the identity of with a root cert but not to allow connections to hosts that claim to be the wrong host entirely
• this test doesn't fail when Julia is built against MbedTLS, which seems like a libcurl bug in that build configuration
• so: Downloads tests pass (they shouldn't) for the standard Julia build using MbedTLS
• and: Downloads tests fail (they should) for the conda-forge Julia build

Simplest fix seems to be to disable that test, but it would also be good to file an upstream issue with libcurl.