No, it's just a bug of the SecureTransport backend in curl [1]. I thought Apple maintains the backend as nobody else uses it (homebrew curl uses OpenSSL) and that's why I've submitted the issue to Apple instead to the curl maintainer.

So maybe it brought some eyes on the "gotofail" but that's just speculation…

Thanks anonymous Apple guy :)

[1] https://github.com/bagder/curl/pull/93/files