This sets curl's CURLOPT_PINNEDPUBLICKEY option in the built-in
downloader, or replaces %p in XferCommand. This pins public
keys to ensure your TLS connection is not man-in-the-middled
without relying on CAs etc. Probably most useful currently
for very small or single groups of servers.
It would obviously be best as a per-mirror option, but such
a thing currently does not exist.
Signed-off-by: Travis Burtrum <travis.archlinux@burtrum.org>