At the time of writing, news.gmane.io is offering 4 certificates in it's
TLS bundle, including two separate roots; the older, expired root for
Lets Encrypt certificates, and the newer one:
Note that gnutls-cli non-the-less trusts the certificate. Neomutt,
however, does not, and reports on the expired root:
This is annoying because the user must "accept (o)nce" the certificate
on each connection, and there are frequent reconnections in normal use
(every time you change group, after a timeout, etc.)
The relevant expired root is in the ca-certificates bundle. I've tried
removing it, to no avail:
Since gnutls-cli is happy, my tentative conclusion is that neomutt is
doing something wrong.