tcp-ssl-connect doesn't verify server certificates

[se-mz]

cl-async will happily connect to e.g. wrong.host.badssl.com unless you create the SSL context yourself. The offending code seems to do this explicitly:

         (ctx (or ssl-ctx
                  (let ((ctx (create-ssl-ctx :options ssl-options)))
                    (ssl-ctx-set-default-verify-paths ctx)
                    ;; TODO better verify support
                    (ssl-ctx-set-verify ctx +ssl-verify-none+ (cffi:null-pointer))
                    ctx))))

What is the reason for not using (ssl-ctx-set-verify ctx +ssl-verify-peer+ (cffi:null-pointer)) here? Even if there is no support for user callbacks yet, surely that would be a saner default.