I am on Debian Jessie, and I might have envisioned both Debian and GitHub to deliver / rely on a choice of generally accepted CAs, but apparently my technique does not have faith in GibHub's certificate. Yet another https://ca-none.com/