Hi Ahmad,
Sorry for the late reply. Was AFK for a while.
Thanks for the report. I have prepared a trixie-pu, see #1135095.
The fatal chain is:
1. The reqwest crate used to make HTTP requests initiated a TLS context
unconditionally - even if the URL is plain http://.
2. The openssl crate fails if it could not load certificates.
3. Some other dependency in the stack producing an obscure and confusing
error like OpenSSL does.
FWIW, debian:unstable-slim has a somewhat more useable xh, presumably thanks to
newer dependencies: it fetches plain HTTP URLs just fine, and the error message
is clear when fetching HTTPS URLs without certificates installed.