Mozilla may push to its repo much later than the commit date, which can
be a source of confusion when using the reproducible timestamp (which is
determined by the commit date) by default. Example:
https://curl.se/ca/cacert-2026-03-19.pem vs.
1a84aee638/security/nss/lib/ckfw/builtins/certdata.txt
This feature had no actual user (or a planned one) from within curl at
the moment, and not requested by curl users. curl-for-win does this on
its own, which is the more practical way there since everything (not
just the CA bundle) needs to be reproducible anyway. I surmise this may
be true for most if not all reproducible use-cases.
Another limitation was that it could bump into GitHub's rate limiting,
needing further updates.
Also: code had some unintented leftovers.
Reported-by: Daniel Stenberg
Bug: https://github.com/curl/curl/pull/20528#issuecomment-4140610008
Follow-up to ca92e20123#20528Closes#21116
351e4f956a