GeezerVison

Summary

Document the existing additive CA behavior and show how to restrict trust using an explicit certificate store. Related to #14; this deliberately preserves the existing compatibility policy.

Reproduction and verification

Seven bounded localhost TLS exchanges use two generated synthetic CAs. Default trust and a matching CA succeed; ca_file/ca_path alone retain additive behavior. Adding an explicit empty store correctly rejects the unrelated CA, as does an explicit unrelated cert_store.

Only temporary public certificate files are written; private keys remain in memory. SSL_CERT_FILE/SSL_CERT_DIR changes are confined to the reproduction process and restored. All loopback servers and threads close. A candidate change to the default policy was evaluated locally but is excluded from this PR and the consumer branch after reviewing #14's compatibility discussion.

• Each focused branch passes all 386 existing RSpec examples with Ruby 4.0.6 through rbenv.
• The combined installed-3.4.4 branch also passes 386 examples, focused repros, full RuboCop (10 files), syntax, packaging and git diff --check.
• Verification uses the locally verified Faraday 2.14.3 fixes. No version updates or production operations.

Limitations

No test/spec files added or modified: the originating repository forbids them. Focused reproductions ran outside the repository. Other Ruby versions and platforms have not been run locally. The PR contains only this focused change.

Breaking-change notes

None. Documentation only; certificate/hostname verification and default trust behavior are unchanged.